CVE-2026-101168

Published: Oct 13, 2026Modified: Oct 14, 2026

6.2

Vector

CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Exploitability: 1.7 / Impact: 4.0

Source: cve@gitlab.com (Secondary)

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.0 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with access to GitLab Pages log data to obtain access tokens and other secrets, due to insertion of sensitive request data into log files and error tracking events.

Affected (6)

Products: Gitlab: Gitlab

Gitlab

1 product

Gitlab

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Gitlab Gitlab	12.0.0 ≤ version < 19.2.8
Gitlab Gitlab	19.3.0 ≤ version < 19.3.5
Gitlab Gitlab	19.4.0 ≤ version < 19.4.2
Gitlab Gitlab	12.0.0 ≤ version < 19.2.8
Gitlab Gitlab	19.3.0 ≤ version < 19.3.5
Gitlab Gitlab	19.4.0 ≤ version < 19.4.2

Related CWEs

CWE-532

Insertion of Sensitive Information into Log File

Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.

References (2)

https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/

Source: cve@gitlab.com

Release NotesVendor Advisory

https://gitlab.com/gitlab-org/gitlab-pages/-/work_items/1187

Source: cve@gitlab.com

Issue Tracking

Timeline

No history available yet.