GitLab EUVD-2026-85731

Exploitation requires the GitLab MCP (Model Context Protocol) search tool feature to be in use and reachable by an authenticated user (PR:L), plus concurrent search activity from multiple user contexts so that the race condition in the tool's shared-state handling can be hit. The trigger is inherently non-deterministic - the attacker must win a timing window (AC:H), which cannot be forced reliably - and the outcome is limited to disclosure of search results under an incorrect user context (C:L only). Instances not using the MCP search tool, or on patched versions (19.2.7, 19.3.3, 19.4.1 and later), are not exposed.

This is a genuinely low-priority issue whose modest CVSS 3.1 base score of 3.1 accurately reflects real-world risk. The vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N combines high attack complexity (AC:H) with a race-condition trigger (CWE-362), meaning exploitation depends on winning a non-deterministic timing window in the MCP search tool's shared-state handling - not something an attacker can reliably force. Impact is limited to low confidentiality (C:L) with no integrity or availability effect: an authenticated user (PR:L) could inadvertently or opportunistically receive search results computed under another user's context, a cross-user information-leak rather than full data compromise. No EPSS score, no CISA KEV listing, and no public POC were provided, and none would be expected for a timing-dependent leak of this nature - exploitation status is best characterized as no public exploit identified at time of analysis. No signals conflict here: low CVSS, high complexity, and absence of exploitation evidence all point the same direction. This is a legitimate defect to patch on a normal cadence, not an emergency.

An authenticated GitLab user issuing MCP (Model Context Protocol) search queries concurrently with other users could, when a race condition in the tool's shared state is hit, receive search results that were resolved under a different user's authorization context, disclosing repository or project data they should not see. Because the trigger is a timing window (AC:H) rather than a deterministic input, reliable exploitation is difficult and success is opportunistic. No public exploit code was identified at the time of analysis.