Introduction
A recently patched input validation flaw in GitLab's Terraform state lock API lets an unauthenticated remote attacker cause a denial-of-service condition by sending crafted JSON payloads. It scores CVSS 7.5. The blast radius is wide. The vulnerable code path existed in every GitLab CE/EE release from version 12.10 onward, and 12.10 first shipped around early 2020, so the flaw sat in the codebase for roughly six years before it was identified and fixed.
GitLab can be the backend for Terraform and OpenTofu state files, and it coordinates locks to prevent concurrent modifications and state corruption. A denial-of-service attack against this endpoint can stall infrastructure deployments, disrupt automated pipelines, and block engineering teams from applying critical infrastructure changes.
Technical Information
Root Cause
The vulnerability is in the Terraform state lock API endpoints in GitLab CE/EE. Normally, locking or unlocking a Terraform state file requires the Maintainer or Owner role and authentication with a private token or a CI job token. In CVE-2026-1092, GitLab parses the JSON payload before it fully enforces authentication checks, which leaves a window in which the server processes unauthenticated requests.
The root cause is classified under CWE-1284: Improper Validation of Specified Quantity in Input. This weakness occurs when a product receives input specifying a quantity (such as size, length, nesting depth, or element count) but fails to validate it correctly. Here, the Terraform state lock endpoint accepted incoming JSON payloads without adequately constraining their quantitative properties before trying to process them.
Attack Flow
Based on the available information, exploitation follows this sequence:
- An attacker identifies a GitLab instance exposed to the network. No authentication is required.
- The attacker crafts a malformed or excessively large JSON payload aimed at the Terraform state lock API endpoint.
- The attacker sends the payload to the endpoint. Because the JSON parsing logic runs before authentication is enforced, the authentication layer does not reject the request.
- The GitLab server tries to parse and process the oversized or deeply nested JSON structure, which consumes excessive CPU, memory, or both.
- Repeated requests amplify the resource exhaustion, which degrades or fully disrupts service for all users of the GitLab instance.
The missing authentication requirement is what raises the severity. Anyone on the network who can reach the GitLab instance can trigger the condition, which is especially concerning for internet-facing deployments.
Patch Information
GitLab fixed CVE-2026-1092 in a coordinated patch release on April 8, 2026. The release ships fixes on three supported branches of both GitLab Community Edition and Enterprise Edition:
| Affected Branch | Vulnerable Versions | Fixed Version |
|---|---|---|
| 18.10 | 18.10 before 18.10.3 | 18.10.3 |
| 18.9 | 18.9 before 18.9.5 | 18.9.5 |
| 12.10 to 18.8 | 12.10 before 18.8.9 | 18.8.9 |
GitLab.com was already running the patched version when the release was announced. Self-managed instances must be upgraded manually.
The fix adds stricter validation of JSON payloads sent to the Terraform state lock endpoint. It enforces proper limits on the structure and size of accepted input before the API processes locking operations, so maliciously crafted requests are rejected early, before they can exhaust server resources.
Security researcher a92847865 reported the vulnerability through GitLab's HackerOne bug bounty program. The issue tracker entry (work item #586479) and the original HackerOne report #3487030 remain confidential and will be publicly disclosed 30 days after the patch release. Until then, the exact code diff and commit-level changes are not publicly available for review.
Until they can deploy the patch, organizations should consider setting request size limits for the Terraform state lock endpoints at their web application firewalls or reverse proxies. It is also advisable to monitor access logs for anomalous traffic against these endpoints.
Affected Systems and Versions
All GitLab CE/EE installations running the following versions are affected:
- Version 12.10 through 18.8.8 (fixed in 18.8.9)
- Version 18.9.0 through 18.9.4 (fixed in 18.9.5)
- Version 18.10.0 through 18.10.2 (fixed in 18.10.3)
Every GitLab release from approximately early 2020 onward carried the vulnerable code path. Both self-managed and dedicated instances are affected. GitLab.com (the SaaS offering) was patched at the time of the advisory.
The vulnerable component is the Terraform state lock API, so instances that use GitLab as a Terraform or OpenTofu state backend are directly affected. The denial of service consumes server resources broadly, though, so every service hosted on the same GitLab instance could degrade.
Vendor Security History
GitLab has a highly mature security posture and runs one of the more active bug bounty programs in the industry on HackerOne. The program reports a 98 percent response efficiency, with an average time to first response of just 10 hours. To date, GitLab has paid security researchers over 6.4 million dollars in total bounties through responsible disclosure channels.
GitLab was named a Leader in the 2025 Gartner Magic Quadrant for DevOps Platforms for the third consecutive year and ranked first in four of six use cases. With enterprise adoption that wide, a vulnerability in a GitLab component carries significant organizational risk across the industry.
