CVE-2026-10087Patch(gitlab / gitlab)

LOWCVSS 8.7 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch gitlab gitlab systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

GitLab has remediated an issue in GitLab EE affecting all versions from 17.1 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to execute arbitrary client-side code on behalf of a targeted user due to improper input sanitization in the Analytics Dashboard.

gitlab CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-79

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

gitlab

Threat summary

Patch or workaround signal is available
7 mentions across 5 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 5 signals
Technical details provided in 5 signals
General: 2 classified signals
Peaked 4d ago at 3 mentions (2026-06-11); latest day: 1
7 total mentions across 5 days

Affected systems

Vendors

gitlab

Products

gitlab

Deep dive

Activity timeline7 mentions / 5d

Signal classification2 categories

Patch

571.4%

General

228.6%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-11	3	General1Patch2
2026-06-12	1	Patch1
2026-06-15	1	Patch1
2026-06-18	1	Patch1
2026-06-26	1	General1

Full discourse7 posts

CCB Alert@CCBalert133d
Patch
Warning: Multiple high vulnerabilities in #GitLab CC/EE #CVE-2026-6552 #CVE-2026-10087 #CVE-2026-7250 #CVE-2026-8589 CVSS: 8.7-7.3 They can lead to Denial of Service #DoS or remote code execution #RCE #Patch #Patch #Patch
Post summary
Multiple high‑severity CVEs identified in GitLab (CVE‑2026‑6552, CVE‑2026‑10087, CVE‑2026‑7250, CVE‑2026‑8589) have associated patches; the advisory highlights the need for immediate remediation.
01011237
7.2K followersView on X
CERT-PY@CERTpy122d
General
⚠️ Vulnerabilidades en productos GitLab ❗ CVE-2026-7250 ❗ CVE-2026-6552 ❗ CVE-2026-10087 ➡️ Más info: https://www.cert.gov.py/vulnerabilidades-en-productos-gitlab-13/ https://t.co/3dbWNxoxwn
Post summary
The post briefly lists three GitLab CVEs and links to a CERT page for additional information, but contains no details on exploitation, patches, or technical aspects.
01010302
6.7K followersView on X
iototsecnews@iototsecnews130d
Patch
GitLab の複数の脆弱性が FIX：アカウント乗っ取り／データ露出などの恐れ https://iototsecnews.jp/2026/06/11/gitlab-patches-multiple-vulnerabilities-allowing-account-takeover/ GitLab に存在する複数の脆弱性には、Group SAML アイデンティティ管理機能における不適切なアクセス制御の欠陥 (CVE-2026-6552) や、Analytics Dashboard コンポーネントにおける入力データのサニタイズ不足 (CVE-2026-10087) などがあります。これらの不備を突く攻撃者は、特定条件下でのアカウント乗っ取りや、悪意のコード実行などを引き起こす可能性があります。ご利用のチームは、ご注意ください。 #CVE202610087 #CVE20266552 #GitLab #OpenSource #Vulnerability
Post summary
GitLab has issued patches for two vulnerabilities (CVE‑2026‑6552 and CVE‑2026‑10087) that could lead to account takeover and code execution; users are advised to apply the updates promptly.
01000147
499 followersView on X
Upwind Security MDR@UpwindMDR137d
Patch
🚨 High - GitLab Analytics Dashboard Stored XSS (CVE-2026-10087) An authenticated attacker with Developer role permissions can inject malicious client-side code through improper input sanitization in the Analytics Dashboard. This can lead to execution of arbitrary JavaScript in the context of a targeted user. Affected: GitLab EE 17.1 → 18.10.7, 18.11 → 18.11.4, 19.0 → 19.0.1 👉Upgrade to GitLab 18.10.8, 18.11.5, 19.0.2
Post summary
The post discloses a high‑severity stored XSS flaw (CVE‑2026‑10087) in GitLab Analytics Dashboard, lists affected releases, and recommends upgrading to specific patched versions.
0001060
216 followersView on X
ADK Cyber@ADKCyber137d
Patch
GitLab EE users: CVE-2026-10087 (CVSS 8.7) remediated. Update if on 17.1 before 18.10.8, 18.11 before 18.11.5, or 19.0 before 19.0.2. via NVD Recent High CVSS #CyberSecurity #InfoSec #Vulnerability https://t.co/rmSKWv35iy
Post summary
The tweet announces that GitLab Enterprise Edition users should update to specific bug‑fixed versions to remediate CVE-2026-10087, a vulnerability with CVSS 8.7. It focuses solely on the patch release and does not mention PoC or exploitation.
0000038
93 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds137d
General
CVE-2026-10087 Arbitrary Client-Side Code Execution in GitLab EE Analytics Dashboard https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-10087
Post summary
The content identifies CVE-2026-10087 as a client‑side code execution flaw in GitLab EE's analytics dashboard and links to a vulnerability details page, but it provides limited technical depth, no exploit evidence, or mitigation guidance.
0000026
4.0K followersView on X
CVE@CVEnew137d
Patch
CVE-2026-10087 GitLab has remediated an issue in GitLab EE affecting all versions from 17.1 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain condition… https://www.cve.org/CVERecord?id=CVE-2026-10087
Post summary
GitLab has issued remediation for CVE‑2026‑10087 across multiple EE versions; the advisory specifies affected releases and indicates a fix is available.
00000162
57.6K followersView on X

CPE platform detail2 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

2 of 2 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	gitlab	gitlab	-	-	-
App	gitlab	gitlab	-	-	-

Explore more

Back to dashboard gitlab CVEs gitlab vulnerabilities

What researchers are saying

CVE-2026-10087

Upwind Security MDR[verified]@UpwindMDRPatch

The post discloses a high‑severity stored XSS flaw (CVE‑2026‑10087) in GitLab Analytics Dashboard, lists affected releases, and recommends upgrading to specific patched versions.

ADK Cyber[verified]@ADKCyberPatch

The tweet announces that GitLab Enterprise Edition users should update to specific bug‑fixed versions to remediate CVE-2026-10087, a vulnerability with CVSS 8.7. It focuses solely on the patch release and does not mention PoC or exploitation.

CCB Alert@CCBalertPatch

Multiple high‑severity CVEs identified in GitLab (CVE‑2026‑6552, CVE‑2026‑10087, CVE‑2026‑7250, CVE‑2026‑8589) have associated patches; the advisory highlights the need for immediate remediation.

CERT-PY@CERTpyGeneral

The post briefly lists three GitLab CVEs and links to a CERT page for additional information, but contains no details on exploitation, patches, or technical aspects.

iototsecnews@iototsecnewsPatch

GitLab has issued patches for two vulnerabilities (CVE‑2026‑6552 and CVE‑2026‑10087) that could lead to account takeover and code execution; users are advised to apply the updates promptly.

Vulmon Vulnerability Feed@VulmonFeedsGeneral

The content identifies CVE-2026-10087 as a client‑side code execution flaw in GitLab EE's analytics dashboard and links to a vulnerability details page, but it provides limited technical depth, no exploit evidence, or mitigation guidance.

CVE@CVEnewPatch

GitLab has issued remediation for CVE‑2026‑10087 across multiple EE versions; the advisory specifies affected releases and indicates a fix is available.