EUVD-2026-50475
GHSA-5c98-v836-vg79
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
Network-accessible, low-complexity exploitation by authenticated users; scope unchanged; only partial confidentiality loss; no integrity or availability impact supported by description.
Primary rating from Vendor (GitLab).
CVSS VectorVendor: GitLab
Lifecycle Timeline
3DescriptionCVE.org
GitLab has remediated an issue in GitLab EE affecting all versions from 18.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed some sensitive information to be disclosed to an unintended host due to improper handling of upstream requests in virtual registries.
AnalysisAI
Sensitive information disclosure in GitLab EE's virtual registries feature allows low-privileged authenticated users to trigger improper forwarding of upstream requests, potentially exposing sensitive data - such as credentials or authentication headers - to unintended hosts. All GitLab EE versions from 18.8 through pre-19.2.1 are affected, with patched releases now available at 19.0.5, 19.1.3, and 19.2.1. No public exploit code has been identified and this vulnerability does not appear in CISA KEV, indicating no confirmed active exploitation at time of analysis.
Technical ContextAI
GitLab EE's virtual registries feature acts as a proxy intermediary, forwarding client requests to configured upstream package registries (such as npm, Maven, or PyPI). The root cause is classified as CWE-522 (Insufficiently Protected Credentials), indicating that sensitive data - likely upstream registry authentication tokens or credentials embedded in request headers - may be transmitted to unintended hosts when the request-routing logic fails to properly validate destination endpoints. The CVSS vector AV:N/AC:L/PR:L/UI:N confirms network-level exploitation by any authenticated user without elevated permissions. Affected CPE is cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:* covering the EE product family across the stated version ranges. The scope of 'sensitive information' is not explicitly enumerated in available data but aligns with upstream registry credential leakage given the CWE classification.
RemediationAI
Upgrade GitLab EE to one of the patched releases: 19.0.5, 19.1.3, or 19.2.1, as documented in the vendor advisory at https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-1-released/. If an immediate upgrade is not operationally feasible, consider disabling the virtual registries feature in GitLab EE administrative settings - this eliminates the vulnerable code path but will interrupt package proxy workflows that depend on it. As an additional compensating control, restricting GitLab EE access to trusted authenticated users (e.g., enforcing SSO or disabling open registration) reduces exposure given the PR:L exploitation prerequisite. Monitoring upstream registry access logs for unexpected or anomalous forwarding destinations can serve as a detection measure while remediation is pending. Exact patch versions are confirmed by the GitLab vendor advisory; no version inference was required.
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. Rated critical severity (CVSS 10
An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.
Unauthenticated arbitrary file read in GitLab CE/EE lets remote attackers retrieve files from the GitLab server via the
The SSH key upload feature (lib/gitlab_keys.rb) in gitlab-shell before 1.7.3, as used in GitLab 5.0 before 5.4.1 and 6.x
A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 allows
Sensitive credential and configuration disclosure in GitLab Enterprise Edition allows an authenticated user with Duo Cha
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
The Ruby SAML library is for implementing the client side of a SAML authorization. Rated critical severity (CVSS 9.8), t
A hardcoded password was set for accounts registered using an OmniAuth provider (e.g. Rated critical severity (CVSS 9.8)
An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.10 before 14.6.5, all versions star
When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab af
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7.9 before 13.8.7, all versions sta
Same weakness CWE-522 – Insufficiently Protected Credentials
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today