CVE-2026-82837: Insertion of Sensitive Information Into Sent Data in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that certain conditions could have allowed an authenticated user to access sensitive credentials and tokens without transiting the expected proxy due to improper authorization checks on internal data emission endpoints.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 19.1.8 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 19.2.6 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 19.3.2
Event History
Frequently Asked Questions
Which GitLab versions need remediation?
GitLab CE/EE is affected from 10.1.0 up to, but not including, 19.1.8; the 19.2 branch before 19.2.6; and the 19.3 branch before 19.3.2. Upgrade to 19.1.8, 19.2.6, 19.3.2, or a later release as applicable.
Does exploitation require an authenticated account?
Yes. The issue could allow an authenticated user to access sensitive credentials and tokens through internal data-emission endpoints because of improper authorization checks.
What information could be exposed?
The reported impact is disclosure of sensitive credentials and tokens. The vulnerability does not describe integrity or availability impact.