CVE-2018-18843: Critical – The Kubernetes integration in GitLab Enterprise Edition 11.x before

CWE Weakness Definitions

CWE-918: Server-Side Request Forgery (SSRF)

Attacker causes the server to make HTTP requests to attacker-chosen destinations, potentially reaching internal services.

Related Attack Patterns (CAPEC)

CAPEC-664 Server Side Request Forgery

via CWE-918

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

This vulnerability was disclosed in 2018. A critical vulnerability affects Gitlab systems (CVE-2018-18843). No public exploit code is currently available. Isolate affected systems if patching is not feasible.

BSID: BS-2018-GLOBAL-003466-C • Model: rule-based-v1 • Confidence: MEDIUM

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →

Frequently Asked Questions

What is CVE-2018-18843?

This vulnerability was disclosed in 2018. A critical vulnerability affects Gitlab systems (CVE-2018-18843). No public exploit code is currently available. Isolate affected systems if patching is not feasible.

What is the CVSS score for CVE-2018-18843?

CVE-2018-18843 has CVSS 10.0 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS: 1.6%.

Is CVE-2018-18843 actively exploited?

No confirmed active exploitation of CVE-2018-18843 as of 2026-09-25.

How do I remediate CVE-2018-18843?

Priority: MEDIUM. Advisory: https://gitlab.com/gitlab-org/gitlab-ce/issues/53158 PSIRT: [email protected]

What systems are affected by CVE-2018-18843?

CVE-2018-18843 affects Gitlab Gitlab.

Vulnerability Details

CVE ID	`CVE-2018-18843`
BSID	`BS-2018-GLOBAL-003466-C` BreachSpider Global ID
CVSS Vector	`CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`
Published	2018-12-04
Last Modified	2026-06-17
ICS Relevance	15%
Weakness (CWE)	Server-Side Request Forgery (SSRF)
Domains	CLOUD
Source	NVD

Official Description

The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4.4 has SSRF.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

Vulnerability details: The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4.4 has SSRF. CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.

Exploitation Likelihood: LOW

Affected Products

Vendor	Product	Affected Versions
Gitlab	Gitlab	`≥ 11.0.0, < 11.2.8` `≥ 11.3.0, < 11.3.9` `≥ 11.4.0, < 11.4.4`

Remediation

View Vendor Advisory →

Remediation Priority: MEDIUM

Vendor PSIRT: [email protected]

Threat Intelligence

● Threat Intelligence Validated: October 2026 | Threat Age: 2872 Days

CISA known-exploited	Not in KEV catalog
Public Exploit	Not confirmed
PoC Code	Not confirmed

AI Enrichment Record — provenance & audit hash

Model	`rule-based-v1`
Confidence	MEDIUM
Enriched At	2026-05-24
SHA-512 Audit Hash	`a80e473f68cb86f5b8073c6a75309ff1ffebf326d4f3409fb0c167bfa8197d1b873530a5abbd8573232f0ea514decb11be89531ac12e20e521b3091163f4c662`

Related CVEs affecting Gitlab

CVE-2019-9174 10.0 An issue was discovered in GitLab Community and Enterprise Edition before 11.... CVE-2020-13300 10.0 GitLab CE/EE version 13.3 prior to 13.3.4 was vulnerable to an OAuth authoriz... CVE-2021-22205 10.0 An issue has been discovered in GitLab CE/EE affecting all versions starting ... CVE-2026-85706 10.0 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18... CVE-2022-2884 9.9 A vulnerability in GitLab CE/EE affecting all versions from 11.3.4 prior to 1...

View all Gitlab CVEs →

Critical Severity - Know Your Exposure

A CVSS 10.0 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →