CVE-2026-12910

GitLab is software teams use to store and manage code and related work. This flaw is like a building entrance where the company badge rule is posted, but one internal door sometimes fails to check it—allowing an already signed-in person to get around the required company sign-in process.

This matters to you if you run GitLab and require people to use SAML single sign-on. It is only a risk under the affected sign-in conditions and when a person already has a GitLab login.

No attackers are known to be exploiting this, and no public attack code is on record. Treat it as routine, timely maintenance: plan the upgrade and verify that your sign-in restrictions continue to work afterward.

Confirm the installed GitLab version and whether SAML SSO restrictions are enabled and relied upon. Upgrade the applicable maintenance branch to 19.1.8, 19.2.6, or 19.3.2, or a later supported release; test the upgrade in a staging environment first and review the vendor release notes, since the findings do not state whether a branch change has compatibility implications.

If upgrading must be delayed, restrict access to GitLab accounts to approved users and review sign-in activity for access that did not follow the intended SAML SSO flow. There is no CISA KEV due date because this CVE is not listed in CISA's Known Exploited Vulnerabilities catalog. After upgrading, verify that SAML SSO restrictions are enforced for the relevant users and investigate unusual account sign-ins or project activity.

CVSS v3.1 is 5.4 (Medium): AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. The issue is CWE-306, Missing Authentication for Critical Function, involving missing authentication-enforcement checks that can permit an authenticated user to bypass SAML SSO sign-in restrictions under certain conditions. It is not listed in CISA KEV, no public exploit code is on record, and EPSS predicts a 0.3% likelihood (25th percentile) with a flat trend. Press attention is new, but that does not establish exploitation.