Executive brief
GitLab has fixed a security issue where sensitive information could be accidentally recorded in the application's internal logs. GitLab is a platform used by developers to manage source code and automate software deployment. If exploited, an administrator or someone with access to the server's logs could view private data that should have been masked, potentially leading to further unauthorized access.
Technical details
An insertion of sensitive information into log files (CWE-532) exists in GitLab CE/EE due to insufficient filtering in a CI/CD API endpoint. Under certain conditions, sensitive data processed by the API was not properly masked before being written to the application logs. An attacker with high-privileged local access (such as a system administrator or a user with log-reading permissions) could exfiltrate this sensitive information. The vulnerability affects versions starting from 9.3 and has been patched in versions 18.11.6, 19.0.3, and 19.1.1. The attack vector is local, requiring high privileges, resulting in a CVSS score of 4.4.
Affected products
- GitLab GitLab CE/EE 9.3 before 18.11.6, 19.0 before 19.0.3, 19.1 before 19.1.1
Timeline
- 2026-06-24: patched: GitLab released versions 19.1.1, 19.0.3, 18.11.6 containing the fix.
- 2026-06-25: advisory: NVD published the CVE record.