CVE-2026-112212

Published: Oct 22, 2026Modified: Oct 22, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:L

Exploitability: 1.6 / Impact: 5.3

Source: cve@gitlab.com (Secondary)

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, an unauthenticated user could have poisoned a shared cache's OAuth/OIDC discovery document to redirect certain flows to an externally controlled server, due to improper trust of user-supplied values when constructing endpoint URLs in cached discovery responses.

Related CWEs

CWE-444

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

References (2)

https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/

Source: cve@gitlab.com

https://gitlab.com/gitlab-org/gitlab/-/work_items/627499

Source: cve@gitlab.com

Timeline

No history available yet.