CVE-2026-101168: Insertion of Sensitive Information into Log File in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.0 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with access to GitLab Pages log data to obtain access tokens and other secrets, due to insertion of sensitive request data into log files and error tracking events.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 19.2.8 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 19.3.5 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 19.4.2
Event History
Frequently Asked Questions
Who is exposed to this issue?
Authenticated users who have access to GitLab Pages log data are the relevant exposure group. The issue could allow such users to obtain access tokens and other secrets recorded in log files or error-tracking events under certain conditions.
Which GitLab versions need remediation?
Affected versions are GitLab CE/EE from 12.0 through versions before 19.2.8, 19.3.5, or 19.4.2, depending on the release line. Updating to 19.2.8, 19.3.5, 19.4.2, or a later version remediates the issue.
What can be done if updating is not immediately possible?
Restrict access to GitLab Pages log data to only users who require it, because access to that data is a stated prerequisite for exposure. Review access tokens and other secrets that may have been included in Pages logs or error-tracking events and rotate them as appropriate.