CVE-2026-7767
5.8MediumPublished 13 Oct 2026 · NVD status: Analyzed · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- Required
- Impact
- High impact on confidentiality
- Weakness
- CWE-601
Impact
An authenticated attacker controlling a Kubernetes agent can steal sensitive authentication tokens by forcing them to be redirected to an arbitrary external server. They need a valid user account and victim interaction via the Kubernetes proxy.
Root cause
The GitLab Kubernetes proxy fails to properly validate destination URLs during HTTP redirects.
Affected systems
GitLab CE/EE versions 13.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2
CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N
Fix & remediation
Upgrade to GitLab CE/EE 19.2.8, 19.3.5, 19.4.2, or later. No interim workaround is documented; disable the GitLab Kubernetes agent proxy if patching must wait.
$ sudo apt-get update && sudo apt-get install --only-upgrade gitlab-eeAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user controlling a Kubernetes agent to cause sensitive authentication tokens to be sent to an unintended server due to improper redirect validation in the Kubernetes proxy.
References
- https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/Release NotesVendor Advisory
- https://gitlab.com/gitlab-org/gitlab/-/work_items/598965Issue Tracking
- https://hackerone.com/reports/3597095Permissions Required