GitLab EUVD-2026-88690

Requires reaching GitLab's GraphQL API on a CE/EE instance running an affected version (15.11 up to before 19.2.7, 19.3 before 19.3.3, or 19.4 before 19.4.1) that has CI/CD job traces containing sensitive variable values. Exploitation is unauthenticated but conditional: the CVSS AC:H and the description's 'under certain conditions' indicate the authorization gap only manifests in specific, non-universal states (likely tied to particular project/job visibility or pipeline configurations not enumerated in available data). Limiting factors: high attack complexity, dependence on those specific conditions being present, impact confined to reading trace contents (no write/exec), and mitigation by upgrading to a fixed release.

This is a low-severity, real-but-modest issue rather than an urgent priority. The CVSS 3.1 base score of 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) captures the tension well: it is network-reachable and unauthenticated (PR:N), but exploitation is gated by high attack complexity (AC:H - the description's 'under certain conditions' qualifier), and impact is limited to partial confidentiality (C:L) with no integrity or availability effect. A public exploit exists (HackerOne report #3590929), which raises exploitability signal, but there is NO CISA KEV listing and NO EPSS score in the provided data, so there is no evidence of active or widespread exploitation. The self-hosted nature and vendor-confirmed patch mean the practical risk is bounded to leaking sensitive CI/CD variable values (e.g., tokens/secrets in job traces) - meaningful for exposed instances but constrained by the conditional trigger. Signals are internally consistent; the main caveat is that the 'certain conditions' are not enumerated in the available data, so defenders cannot precisely scope which instances are vulnerable without the vendor advisory.

An unauthenticated attacker sends a crafted GraphQL query to a self-hosted or GitLab.com project that, under specific conditions, is not properly authorization-checked, retrieving CI/CD job trace output that contains masked or embedded sensitive variable values such as deployment tokens or API secrets. Because the flaw is remotely reachable without credentials, the attacker needs only network access to the GraphQL endpoint; however, the high attack complexity means the vulnerable conditions must be present. A public proof-of-concept is available via HackerOne report #3590929.