InfoSecBulletin Cybersecurity for mankind
GitLab patches six vulnerabilities in Community Edition (CE) and Enterprise Edition (EE), with versions 18.2.1, 18.1.3, and 18.0.5 now ready for deployment.
The release addresses six security vulnerabilities, including two serious cross-site scripting (XSS) issues that threaten Kubernetes proxy functionality.
Researchers show new technique to bypass AI safety guardrails in Grok and Gemini
About thousands of leaked AWS keys Held Full Admin Rights
US Bank investigates LockBit’s Data Breach Claims
Five new malware families actively targeting Asian Gov.t infra
T-Mobile Cuts Cables to Remove Chiness Salt Typhoon Hackers from Network
Splunk, Zyxel Patch Multiple Flaws Enabling RCE and Root Command Execution
“Zombie Card” attack revels expired Visa card may be used for contactless payments
Critical Zimbra RCE Flaw Actively Exploited in the Wild
Operation CameraSwarm
A single hacker compromise 1400+ Dahua camera worldwide
Cl0p Ransomware Listed 40+ Victims of PTC Windchill Campaign
These patches address vulnerabilities found in GitLab’s HackerOne bug bounty program. Immediate action is highly advised for all self-managed installations.
Kubernetes Proxy Vulnerabilities:
This patch cycle addresses the most critical vulnerabilities, specifically targeting cross-site scripting attacks that exploit GitLab’s Kubernetes proxy functionality.
CVE-2025-4700, with a CVSS score of 8.7, impacts the Kubernetes proxy feature and may let authenticated attackers cause unintended content rendering, resulting in XSS in certain situations.
The vulnerability impacts all GitLab CE/EE versions from 15.10 before the current patches.
CVE-2025-4439 also tackles a related XSS vulnerability that specifically impacts instances delivered via content delivery networks (CDNs), assigned a CVSS score of 7.7.
The security researcher joaxcar identified both vulnerabilities via the HackerOne platform, underscoring the success of GitLab’s bug bounty program in uncovering significant security issues.
Information Disclosure and Access Control Issues:
Four medium-severity vulnerabilities complete the security patch roster, each carrying CVSS scores of 4.3.
CVE-2025-7001 reveals a sensitive information leak via resource_group API access. CVE-2025-4976 corrects access control issues for internal notes in GitLab Duo responses for Enterprise Edition users.
CVE-2025-0765 and CVE-2025-1299 fix problems with unauthorized access to service desk emails and deployment job logs.
These vulnerabilities show the thorough security review by GitLab’s team, with researchers iamgk808, rogerace, and pwnie responsibly disclosing their findings.
GitLab urges all users to upgrade to the latest patch versions immediately, noting that GitLab.com is already using these versions, while GitLab Dedicated customers do not need to take any action.
