Vulnerability Reportgitlab/gitlab-ce:19.2.1-ce.0

gitlab/gitlab-ce:latestgitlab/gitlab-ce:rcgitlab/gitlab-ce:19.2.1-ce.0
digestsha256:2777b4a990a05a40947437d3c8e0e03347974d8998663d266064cebaff00ba87

Executive Summary

Last scanned:

Threat Score
75/100DANGEROUS
Reputation
RELIABLE

This image poses a critical security risk and must not be used in production, especially as an internet-facing service. An attacker could exploit CVE-2026-42496 to perform path traversal and read or write arbitrary files during archive extraction, or leverage CVE-2026-42010 for authentication bypass if RSA-PSK is enabled. Note: CVE-2026-42010 only applies if RSA-PSK key exchange is configured, which is not the default. Immediate patching is required to address these and other severe vulnerabilities.

Vulnerabilities

Vulnerability Log

97 total
CVE IDAdjusted SeverityPackageExploit ProbabilityRisk Context
CVE-2026-42010HIGH7.84
libgnutls30t64
3.8.3-1.1ubuntu3.5
fixed in 3.8.3-1.1ubuntu3.6
1.1%
Low-Moderate Risk
Directly ExposedContext importance: MEDIUM
CVE-2026-42496HIGH7.73
libperl5.38t64
5.38.2-3.2ubuntu0.2
fixed in 5.38.2-3.2ubuntu0.3
0.4%
Theoretical Threat
Directly ExposedContext importance: HIGH
CVE-2026-41989MEDIUM6.38
libgcrypt20
1.10.3-2build1
fixed in 1.10.3-2ubuntu0.1
0.2%
Theoretical Threat
Directly ExposedContext importance: HIGH
CVE-2026-42496MEDIUM6.18
perl
5.38.2-3.2ubuntu0.2
fixed in 5.38.2-3.2ubuntu0.3
0.4%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-42496MEDIUM6.18
perl-base
5.38.2-3.2ubuntu0.2
fixed in 5.38.2-3.2ubuntu0.3
0.4%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-42496MEDIUM6.18
perl-modules-5.38
5.38.2-3.2ubuntu0.2
fixed in 5.38.2-3.2ubuntu0.3
0.4%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-42014MEDIUM5.61
libgnutls30t64
3.8.3-1.1ubuntu3.5
fixed in 3.8.3-1.1ubuntu3.6
0.1%
Theoretical Threat
Directly Exposed
CVE-2026-42013MEDIUM5.58
libgnutls30t64
3.8.3-1.1ubuntu3.5
fixed in 3.8.3-1.1ubuntu3.6
0.4%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-5260MEDIUM5.58
libgnutls30t64
3.8.3-1.1ubuntu3.5
fixed in 3.8.3-1.1ubuntu3.6
0.7%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-6238MEDIUM5.52
libc-bin
2.39-0ubuntu8.7
No fix yet
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-4437MEDIUM5.52
libc6
2.39-0ubuntu8.7
No fix yet
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-6238MEDIUM5.52
libc6
2.39-0ubuntu8.7
No fix yet
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-59998MEDIUM5.52
openssh-server
1:9.6p1-3ubuntu13.16
fixed in 1:9.6p1-3ubuntu13.18
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-60001MEDIUM5.52
openssh-server
1:9.6p1-3ubuntu13.16
fixed in 1:9.6p1-3ubuntu13.18
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-59998MEDIUM5.52
openssh-sftp-server
1:9.6p1-3ubuntu13.16
fixed in 1:9.6p1-3ubuntu13.18
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-60001MEDIUM5.52
openssh-sftp-server
1:9.6p1-3ubuntu13.16
fixed in 1:9.6p1-3ubuntu13.18
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-40226MEDIUM5.44
libsystemd0
255.4-1ubuntu8.15
fixed in 255.4-1ubuntu8.16
<0.1%
Theoretical Threat
Directly Exposed
CVE-2026-40226MEDIUM5.44
libudev1
255.4-1ubuntu8.15
fixed in 255.4-1ubuntu8.16
<0.1%
Theoretical Threat
Directly Exposed
CVE-2026-13757MEDIUM5.27
libp11-kit0
0.25.3-4ubuntu2.1
No fix yet
0.1%
Theoretical Threat
Directly Exposed
CVE-2026-55655MEDIUM5.18
openssh-server
1:9.6p1-3ubuntu13.16
No fix yet
<0.1%
Theoretical Threat
Directly Exposed
CVE-2026-55655MEDIUM5.18
openssh-sftp-server
1:9.6p1-3ubuntu13.16
No fix yet
<0.1%
Theoretical Threat
Directly Exposed
CVE-2026-59999MEDIUM5.1
openssh-server
1:9.6p1-3ubuntu13.16
fixed in 1:9.6p1-3ubuntu13.18
0.1%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-60000MEDIUM5.1
openssh-server
1:9.6p1-3ubuntu13.16
fixed in 1:9.6p1-3ubuntu13.18
0.4%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-59999MEDIUM5.1
openssh-sftp-server
1:9.6p1-3ubuntu13.16
fixed in 1:9.6p1-3ubuntu13.18
0.1%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-60000MEDIUM5.1
openssh-sftp-server
1:9.6p1-3ubuntu13.16
fixed in 1:9.6p1-3ubuntu13.18
0.4%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-3833MEDIUM5.03
libgnutls30t64
3.8.3-1.1ubuntu3.5
fixed in 3.8.3-1.1ubuntu3.6
0.6%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-42011MEDIUM5.03
libgnutls30t64
3.8.3-1.1ubuntu3.5
fixed in 3.8.3-1.1ubuntu3.6
0.5%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-5435MEDIUM5.02
libc-bin
2.39-0ubuntu8.7
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-5435MEDIUM5.02
libc6
2.39-0ubuntu8.7
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-42012MEDIUM4.82
libgnutls30t64
3.8.3-1.1ubuntu3.5
fixed in 3.8.3-1.1ubuntu3.6
0.4%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2024-2236MEDIUM4.72
libgcrypt20
1.10.3-2build1
No fix yet
1.1%
Low-Moderate Risk
Directly ExposedContext importance: MEDIUM
CVE-2026-27171MEDIUM4.67
zlib1g
1:1.3.dfsg-3.1ubuntu2.1
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-33845MEDIUM4.64
libgnutls30t64
3.8.3-1.1ubuntu3.5
fixed in 3.8.3-1.1ubuntu3.6
0.8%
Theoretical Threat
Directly Exposed
CVE-2026-59995MEDIUM4.59
openssh-server
1:9.6p1-3ubuntu13.16
fixed in 1:9.6p1-3ubuntu13.18
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-59996MEDIUM4.59
openssh-server
1:9.6p1-3ubuntu13.16
fixed in 1:9.6p1-3ubuntu13.18
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-59997MEDIUM4.59
openssh-server
1:9.6p1-3ubuntu13.16
fixed in 1:9.6p1-3ubuntu13.18
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-59995MEDIUM4.59
openssh-sftp-server
1:9.6p1-3ubuntu13.16
fixed in 1:9.6p1-3ubuntu13.18
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-59996MEDIUM4.59
openssh-sftp-server
1:9.6p1-3ubuntu13.16
fixed in 1:9.6p1-3ubuntu13.18
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-59997MEDIUM4.59
openssh-sftp-server
1:9.6p1-3ubuntu13.16
fixed in 1:9.6p1-3ubuntu13.18
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-33846MEDIUM4.5
libgnutls30t64
3.8.3-1.1ubuntu3.5
fixed in 3.8.3-1.1ubuntu3.6
1.3%
Low-Moderate Risk
Directly Exposed
CVE-2026-42009MEDIUM4.5
libgnutls30t64
3.8.3-1.1ubuntu3.5
fixed in 3.8.3-1.1ubuntu3.6
1.3%
Low-Moderate Risk
Directly Exposed
CVE-2026-4046MEDIUM4.5
libc-bin
2.39-0ubuntu8.7
No fix yet
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-4046MEDIUM4.5
libc6
2.39-0ubuntu8.7
No fix yet
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-42015MEDIUM4.5
libgnutls30t64
3.8.3-1.1ubuntu3.5
fixed in 3.8.3-1.1ubuntu3.6
0.7%
Theoretical Threat
Directly Exposed
CVE-2026-34743MEDIUM4.5
liblzma5
5.6.1+really5.4.5-1ubuntu0.2
fixed in 5.6.1+really5.4.5-1ubuntu0.3
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-4437MEDIUM4.42
libc-bin
2.39-0ubuntu8.7
No fix yet
0.3%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-27456MEDIUM4
libblkid1
2.39.3-9ubuntu6.5
No fix yet
0.1%
Theoretical Threat
Directly Exposed
CVE-2026-27456MEDIUM4
libmount1
2.39.3-9ubuntu6.5
No fix yet
0.1%
Theoretical Threat
Directly Exposed
CVE-2026-27456MEDIUM4
libsmartcols1
2.39.3-9ubuntu6.5
No fix yet
0.1%
Theoretical Threat
Directly Exposed
CVE-2026-27456MEDIUM4
libuuid1
2.39.3-9ubuntu6.5
No fix yet
0.1%
Theoretical Threat
Directly Exposed
CVE-2021-31879LOW3.66
wget
1.21.4-1ubuntu4.1
No fix yet
1.1%
Low-Moderate Risk
Post-Exploit
CVE-2026-58471LOW3.62
wget
1.21.4-1ubuntu4.1
fixed in 1.21.4-1ubuntu4.3
0.2%
Theoretical Threat
Post-Exploit
CVE-2026-58472LOW3.62
wget
1.21.4-1ubuntu4.1
fixed in 1.21.4-1ubuntu4.3
0.2%
Theoretical Threat
Post-Exploit
CVE-2026-4438LOW3.4
libc-bin
2.39-0ubuntu8.7
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-4438LOW3.4
libc6
2.39-0ubuntu8.7
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-59998LOW3.31
openssh-client
1:9.6p1-3ubuntu13.16
fixed in 1:9.6p1-3ubuntu13.18
0.2%
Theoretical Threat
Post-Exploit
CVE-2026-60001LOW3.31
openssh-client
1:9.6p1-3ubuntu13.16
fixed in 1:9.6p1-3ubuntu13.18
0.3%
Theoretical Threat
Post-Exploit
CVE-2026-3832LOW3.15
libgnutls30t64
3.8.3-1.1ubuntu3.5
fixed in 3.8.3-1.1ubuntu3.6
0.7%
Theoretical Threat
Directly Exposed
CVE-2026-5419LOW3.15
libgnutls30t64
3.8.3-1.1ubuntu3.5
fixed in 3.8.3-1.1ubuntu3.6
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-55654LOW3.15
openssh-server
1:9.6p1-3ubuntu13.16
No fix yet
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-55654LOW3.15
openssh-sftp-server
1:9.6p1-3ubuntu13.16
No fix yet
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-55655LOW3.11
openssh-client
1:9.6p1-3ubuntu13.16
No fix yet
<0.1%
Theoretical Threat
Post-Exploit
CVE-2026-15146LOW3.01
wget
1.21.4-1ubuntu4.1
No fix yet
0.1%
Theoretical Threat
Post-Exploit
CVE-2026-8376LOW3
libperl5.38t64
5.38.2-3.2ubuntu0.2
fixed in 5.38.2-3.2ubuntu0.3
0.4%
Theoretical Threat
Post-Exploit
CVE-2026-8376LOW3
perl
5.38.2-3.2ubuntu0.2
fixed in 5.38.2-3.2ubuntu0.3
0.4%
Theoretical Threat
Post-Exploit
CVE-2026-8376LOW3
perl-base
5.38.2-3.2ubuntu0.2
fixed in 5.38.2-3.2ubuntu0.3
0.4%
Theoretical Threat
Post-Exploit
CVE-2026-8376LOW3
perl-modules-5.38
5.38.2-3.2ubuntu0.2
fixed in 5.38.2-3.2ubuntu0.3
0.4%
Theoretical Threat
Post-Exploit
CVE-2026-60002LOW2.87
openssh-client
1:9.6p1-3ubuntu13.16
fixed in 1:9.6p1-3ubuntu13.18
0.3%
Theoretical Threat
Post-Exploit
CVE-2026-60002LOW2.87
openssh-server
1:9.6p1-3ubuntu13.16
fixed in 1:9.6p1-3ubuntu13.18
0.3%
Theoretical Threat
Post-Exploit
CVE-2026-60002LOW2.87
openssh-sftp-server
1:9.6p1-3ubuntu13.16
fixed in 1:9.6p1-3ubuntu13.18
0.3%
Theoretical Threat
Post-Exploit
CVE-2025-45582LOW2.86
tar
1.35+dfsg-3build1
fixed in 1.35+dfsg-3ubuntu0.2
0.4%
Theoretical Threat
Post-Exploit
CVE-2023-42366LOW2.8
busybox
1:1.36.1-6ubuntu3.1
No fix yet
0.4%
Theoretical Threat
Post-Exploit
CVE-2026-5704LOW2.8
tar
1.35+dfsg-3build1
fixed in 1.35+dfsg-3ubuntu0.3
0.4%
Theoretical Threat
Post-Exploit
CVE-2026-40228LOW2.8
libsystemd0
255.4-1ubuntu8.15
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-40228LOW2.8
libudev1
255.4-1ubuntu8.15
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2025-60876LOW2.75
busybox
1:1.36.1-6ubuntu3.1
No fix yet
0.3%
Theoretical Threat
Post-Exploit
CVE-2026-59995LOW2.75
openssh-client
1:9.6p1-3ubuntu13.16
fixed in 1:9.6p1-3ubuntu13.18
0.2%
Theoretical Threat
Post-Exploit
CVE-2026-59996LOW2.75
openssh-client
1:9.6p1-3ubuntu13.16
fixed in 1:9.6p1-3ubuntu13.18
0.2%
Theoretical Threat
Post-Exploit
CVE-2026-59997LOW2.75
openssh-client
1:9.6p1-3ubuntu13.16
fixed in 1:9.6p1-3ubuntu13.18
0.2%
Theoretical Threat
Post-Exploit
CVE-2026-58470LOW2.7
wget
1.21.4-1ubuntu4.1
fixed in 1.21.4-1ubuntu4.3
0.2%
Theoretical Threat
Post-Exploit
CVE-2026-27456LOW2.4
bsdutils
1:2.39.3-9ubuntu6.5
No fix yet
0.1%
Theoretical Threat
Post-Exploit
CVE-2026-41991LOW2.4
gzip
1.12-1ubuntu3.1
fixed in 1.12-1ubuntu3.2
0.1%
Theoretical Threat
Post-Exploit
CVE-2026-27456LOW2.4
mount
2.39.3-9ubuntu6.5
No fix yet
0.1%
Theoretical Threat
Post-Exploit
CVE-2026-27456LOW2.4
util-linux
2.39.3-9ubuntu6.5
No fix yet
0.1%
Theoretical Threat
Post-Exploit
CVE-2026-41992LOW2.29
gzip
1.12-1ubuntu3.1
fixed in 1.12-1ubuntu3.2
0.3%
Theoretical Threat
Post-Exploit
CVE-2026-59999LOW2.29
openssh-client
1:9.6p1-3ubuntu13.16
fixed in 1:9.6p1-3ubuntu13.18
0.1%
Theoretical Threat
Post-Exploit
CVE-2026-60000LOW2.29
openssh-client
1:9.6p1-3ubuntu13.16
fixed in 1:9.6p1-3ubuntu13.18
0.4%
Theoretical Threat
Post-Exploit
CVE-2026-55654LOW1.89
openssh-client
1:9.6p1-3ubuntu13.16
No fix yet
0.4%
Theoretical Threat
Post-Exploit
CVE-2024-56433LOW1.84
login
1:4.13+dfsg1-4ubuntu3.2
No fix yet
0.4%
Theoretical Threat
Post-Exploit
CVE-2024-56433LOW1.84
passwd
1:4.13+dfsg1-4ubuntu3.2
No fix yet
0.4%
Theoretical Threat
Post-Exploit
CVE-2025-46394LOW1.68
busybox
1:1.36.1-6ubuntu3.1
No fix yet
0.1%
Theoretical Threat
Post-Exploit
CVE-2025-69720NONE0
libncursesw6
6.4+20240113-1ubuntu2
fixed in 6.4+20240113-1ubuntu2.1
0.4%
Theoretical Threat
Not Applicable
CVE-2025-69720NONE0
libtinfo6
6.4+20240113-1ubuntu2
fixed in 6.4+20240113-1ubuntu2.1
0.4%
Theoretical Threat
Not Applicable
CVE-2025-69720NONE0
ncurses-base
6.4+20240113-1ubuntu2
fixed in 6.4+20240113-1ubuntu2.1
0.4%
Theoretical Threat
Not Applicable
CVE-2025-69720NONE0
ncurses-bin
6.4+20240113-1ubuntu2
fixed in 6.4+20240113-1ubuntu2.1
0.4%
Theoretical Threat
Not Applicable
CVE-2024-58251NONE0
busybox
1:1.36.1-6ubuntu3.1
No fix yet
0.2%
Theoretical Threat
Not Applicable
CVE-2026-58469NONE0
wget
1.21.4-1ubuntu4.1
fixed in 1.21.4-1ubuntu4.3
0.4%
Theoretical Threat
Not Applicable

Reachability analysis

Which CVEs are actually reachable — is the vulnerable code even linked and callable.

Locked

Runtime verification

Live-container probes: default user, writable paths, capabilities, exposed ports.

Locked

Hardening recommendations

A step-by-step hardened build plan, with parity tests proving nothing breaks.

Locked

Want to check another image? Run a full scan with the Docker Security Scanner.