What is the CVSS score of CVE-2026-8330?

CVE-2026-8330 has a CVSS 3.1 base score of 4.4 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-8330?

Yes, a patch is available for CVE-2026-8330. Update the affected software to the latest version immediately.

GitLab CE/EE CVE-2026-8330

EUVD-2026-39172 MEDIUM

Insertion of Sensitive Information into Log File (CWE-532)

2026-06-25 cve@gitlab.com

GHSA-6q88-cw72-pm5w

Information Disclosure Gitlab

4.4

CVSS 3.1 · Vendor: gitlab

Severity by source

Vendor (gitlab) PRIMARY

4.4 MEDIUM

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

4.4 MEDIUM

Local access to server logs (AV:L) and high OS/admin privileges (PR:H) required; only confidentiality impacted, no integrity or availability effect.

3.1 AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (gitlab).

CVSS VectorVendor: gitlab

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jun 25, 2026 - 07:01 EUVD

Analysis Generated

Jun 25, 2026 - 05:35 vuln.today

DescriptionCVE.org

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.3 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed sensitive information to be written to application logs due to insufficient filtering in a CI/CD API endpoint.

AnalysisAI

Sensitive data exposure in GitLab CE/EE affects all instances running versions from 9.3 through 18.11.5, 19.0 through 19.0.2, and 19.1.0, where under certain conditions a CI/CD API endpoint fails to adequately filter sensitive information before writing it to application logs. A high-privileged local actor who can access application log files on the GitLab server may recover sensitive data that should never have been persisted. No public exploit code exists and this vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation at time of analysis.

Technical ContextAI

CWE-532 (Insertion of Sensitive Information into Log File) describes the root cause: the application fails to sanitize or mask sensitive values before passing them to its logging subsystem. Specifically, a GitLab CI/CD API endpoint processes inputs or responses that may include credentials, tokens, or other secret material, and the filtering logic responsible for redacting these values is insufficient under certain (undisclosed) conditions. GitLab CE/EE is a self-hosted DevSecOps platform built on Ruby on Rails with extensive CI/CD pipeline functionality; its application logs are typically written to disk on the GitLab server and accessible only to OS-level administrators. No CPE string was provided, but the affected scope spans the GitLab CE and EE product lines from version 9.3 onward through the fixed releases.

RemediationAI

Upgrade GitLab CE/EE to one of the vendor-patched releases: 18.11.6, 19.0.3, or 19.1.1, as documented in the patch advisory at https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-1-1-released/. If an immediate upgrade is not feasible, compensating controls should focus on restricting access to application log files - ensure that GitLab log directories (typically /var/log/gitlab/) are readable only by the gitlab-www user and OS-level administrators, and audit which accounts have shell or sudo access to the server. Additionally, consider rotating any CI/CD secrets, tokens, or credentials that may have been processed through the affected CI/CD API endpoint during the exposure window. Note that log access restrictions do not prevent the sensitive data from being written to logs; they only limit who can read it, so upgrading remains the definitive fix. No workarounds that eliminate the root cause are identified in available data.