The vulnerability is a server‑side request forgery (SSRF) in the virtual registry component of GitLab Enterprise Edition. An authenticated user who controls the upstream registry configuration can cause GitLab to send HTTP requests to arbitrary internal hosts that are normally unreachable from the public internet. This occurs because the upstream URL is not properly validated, allowing an attacker to probe internal services, potentially exfiltrate data or further compromise the internal network. The weakness is identified as CWE‑918.

The affected vendor is GitLab. All GitLab Enterprise Edition releases from 18.8, 18.10, and 18.11 prior to the patch versions 18.9.7, 18.10.6, and 18.11.3 respectively are vulnerable. Newer releases beyond those versions are not affected.

The CVSS score is 3.5, indicating low overall severity, and there is no EPSS score available. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires an authenticated user with control over virtual registry upstream configuration, so an internal attacker or a compromised user account could exploit it. Without an upgrade, an attacker could make GitLab send requests to internal services, potentially revealing sensitive information or enabling further lateral movement within the internal network.