CVE-2026-105777: Insertion of Sensitive Information Into Sent Data in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6.5 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, an unauthenticated user could have retrieved sensitive internal server credentials due to improper filtering of internal response headers.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 19.3.6 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 19.4.3 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 19.5.1
Event History
Frequently Asked Questions
Which GitLab releases need to be updated?
Affected releases are GitLab CE/EE from 17.6.5 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1. Update to 19.3.6, 19.4.3, 19.5.1, or a later release in the applicable release line.
Does an attacker need a GitLab account to exploit this issue?
No. The issue may allow an unauthenticated user to retrieve sensitive internal server credentials under certain conditions.
What is the stated security impact?
The reported impact is limited to disclosure of sensitive internal server credentials. The supplied severity vector indicates low confidentiality impact and no integrity or availability impact.