GitLab CE/EE CVE-2026-112212

Exploitation requires that GitLab is using a shared/cached OAuth or OIDC discovery mechanism whose discovery-document responses are served from a cache that an unauthenticated attacker can poison with user-supplied values used to construct endpoint URLs ('under certain conditions' per the description). Limiting factors: the attack is high-complexity (the attacker must successfully influence and seed the shared cache), and it requires user interaction (UI:R) - a legitimate user must subsequently start an affected OAuth/OIDC flow so the poisoned endpoint is actually used. Only GitLab CE/EE versions from 18.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 are affected; patched releases (19.3.6, 19.4.3, 19.5.1) remove the condition. Deployments not using the affected OAuth/OIDC discovery/caching path are not exposed.

This is a moderate-priority issue rather than an emergency. The provided CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:L, base 7.5) shows a network-reachable, unauthenticated (PR:N) flaw, but two metrics materially suppress real-world risk: AC:H reflects the 'under certain conditions' language (the attacker must win a cache-poisoning condition against a shared discovery cache), and UI:R means a legitimate user must subsequently initiate an affected OAuth/OIDC flow for the poisoned endpoint to be used. Scope is Changed (S:C) because a poisoned discovery document can redirect authentication flows to an externally controlled server, impacting components/identities beyond GitLab itself, which justifies the HIGH confidentiality rating. No exploitation-probability signals accompany this record - no EPSS score, no CISA KEV listing, and no public exploit were supplied - so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net: a credible, vendor-reported authentication-integrity weakness worth patching on a normal cycle, but the AC:H + UI:R combination makes opportunistic mass exploitation unlikely absent a public POC. Note a labeling tension to verify: the CWE is CWE-444 and a 'Request Smuggling' tag is applied, yet the description describes cache poisoning of an OAuth/OIDC discovery document via improper trust of user-supplied values when constructing endpoint URLs - confirm the precise mechanism with GitLab before treating this as classic HTTP request smuggling.

An unauthenticated attacker sends crafted requests containing attacker-influenced host/URL values that get stored in GitLab's shared OAuth/OIDC discovery-document cache. When a victim later begins an affected OAuth/OIDC flow, GitLab serves the poisoned discovery document and the victim's flow is redirected to an attacker-controlled endpoint, enabling disclosure or interception of authentication data. No public exploit code was provided in the source data, and the AC:H/UI:R profile means success depends on cache timing and a user initiating the flow.