CVE-2026-101168
6.2MediumPublished 13 Oct 2026 · NVD status: Analyzed · AI triage by gemini-3.8-flash
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
- Impact
- High impact on confidentiality
- Weakness
- CWE-532
Impact
An authenticated adjacent user with read access to GitLab Pages logs can steal access tokens and other secrets. The leaked credentials allow impersonation and unauthorized data access across the platform.
Root cause
GitLab Pages inserts sensitive request data directly into log files and error tracking events.
Affected systems
GitLab CE/EE versions 12.0 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2
CVSS v3.1 · CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Fix & remediation
Upgrade GitLab to version 19.2.8, 19.3.5, 19.4.2, or later. If you cannot patch immediately, restrict file-level and platform access to GitLab Pages log files and error tracking outputs.
$ sudo apt-get update && sudo apt-get install --only-upgrade gitlab-eeAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.0 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with access to GitLab Pages log data to obtain access tokens and other secrets, due to insertion of sensitive request data into log files and error tracking events.
References
- https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/Release NotesVendor Advisory
- https://gitlab.com/gitlab-org/gitlab-pages/-/work_items/1187Issue Tracking