Executive brief
GitLab is a widely-used platform for source code management and CI/CD pipelines. An authentication bypass vulnerability allowed authenticated users to access sensitive credentials and tokens by circumventing the expected security proxy. An attacker with valid GitLab credentials could extract API tokens, deploy keys, and other secrets, potentially leading to further system compromise and unauthorized access to downstream systems.
Technical details
This vulnerability is a broken authorization (CWE-863) issue affecting GitLab CE/EE versions 10.1.0 through 19.1.7, 19.2.0 through 19.2.5, and 19.3.0 through 19.3.1. The flaw resides in internal data emission endpoints that lacked proper authorization checks, allowing authenticated users to bypass the expected proxy authentication layer and retrieve sensitive credentials and tokens. The attack requires valid authentication to the GitLab instance but does not require additional user interaction. Successful exploitation could grant an attacker access to API tokens, deployment credentials, and other sensitive data. Patches are available in versions 19.1.8, 19.2.6, and 19.3.2 or later.
Affected products
- GitLab GitLab CE/EE 10.1.0 before 19.1.8, 19.2 before 19.2.6, 19.3 before 19.3.2
Timeline
- 2026-09-15: disclosed
- 2026-09-15: patched: Patches released in versions 19.1.8, 19.2.6, and 19.3.2