GitLabCVE-2026-105777

GitLab: information disclosure

CVE-2026-105777 · Published Oct 22, 2026 · updated Oct 30, 2026

Medium4.3

Fix: upgrade to 19.3.6 or later (3 fixed versions below)

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6.5 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, an unauthenticated user could have retrieved sensitive internal server credentials due to improper filtering of internal response headers.

Affected versions

Package	Affected	Fixed in
GitLab Product	>= 17.6.5, < 19.3.6	19.3.6
	>= 19.4, < 19.4.3	19.4.3
	>= 19.5, < 19.5.1	19.5.1

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Severity from: the vendor (its own CVE record or advisory)
Weakness: CWE-201

More GitLab advisories

All GitLab

Medium 6.8Oct 22

GitLab: improper authorizationCVE-2026-12664fixed in 19.3.6 +2 Medium 4.3Oct 22

GitLab: missing authorizationCVE-2026-13319fixed in 19.3.6 +2 Low 3.1Oct 22

GitLab: improper access controlCVE-2026-14288fixed in 19.3.6 +2 High 8.2Oct 22

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1...CVE-2026-15723fixed in 19.3.6 +2 Medium 5.9Oct 22

GitLab: improper authorizationCVE-2026-16255fixed in 19.3.6 +2 Medium 4.3Oct 22

GitLab: authenticated user could access paid AI features withoutCVE-2026-112378fixed in 19.3.6 +2