Is CVE-2022-51026 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-51026 being exploited in the wild.

How severe is CVE-2022-51026?

Critical severity, with a CVSS score of 9.8, published 22 October 2026.

Is there a fix for CVE-2022-51026?

Yes: fixed in 1.0.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2022-51026 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2022-51026?

Check whether you run Bytebase at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-51026: Bytebase authentication bypass in GitLab login

CVE-2022-51026 · Severity: critical · CVSS 9.8 · Published 2026-10-22

Bytebase is a database governance and access control platform. Versions 0.12.0 through 1.0.0 contain a critical flaw in GitLab authentication that allows attackers to impersonate any user, including administrators, without credentials by redirecting authentication to a malicious server they control.

Technologies: Bytebase. Vendors: Bytebase.

Quick answers

Is CVE-2022-51026 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-51026 being exploited in the wild.
How severe is CVE-2022-51026?: Critical severity, with a CVSS score of 9.8, published 22 October 2026.
Which products and versions are affected?: Bytebase 0.12.0 before 1.0.1.
Is there a fix for CVE-2022-51026?: Yes: fixed in 1.0.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-51026 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2022-51026?: Check whether you run Bytebase at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 1.0.1

Technical details

The vulnerability exists in the POST /api/auth/login/GITLAB_SELF_HOST endpoint, which incorrectly trusts the client-supplied instanceUrl parameter. An attacker can set instanceUrl to a server they control that returns an active user with any chosen email address. Bytebase then issues valid session tokens for the impersonated principal, enabling account takeover or creation of new admin accounts.

Affected products

Bytebase Bytebase 0.12.0 before 1.0.1

Timeline

2022-10-22: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.