CVE-2026-3855

score

0.2

cvss

3.1

epss

0.3%

published

2026-09-16

kev added

—

first seen

2026-10-21

GitLab CE/EE >= 18.2.7 < 19.1.8, 19.2 < 19.2.6, and 19.3 < 19.3.2 contain an information disclosure and denial of service vulnerability caused by improper validation of parameters in the Terraform state upload functionality, letting authenticated users with project-level permissions access restricted file contents or cause denial of service.