CVE-2025-0194: GitLab Information Disclosure Vulnerability

CVE-2025-0194 Overview

CVE-2025-0194 is an information disclosure vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE). Under certain conditions, access tokens were written to GitLab logs when API requests were issued in a specific manner. The flaw maps to [CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory].

The issue affects versions 17.4 through 17.5.4, 17.6 through 17.6.2, and 17.7.0. GitLab patched the issue in releases 17.5.5, 17.6.3, and 17.7.1, published on January 8, 2025.

Critical Impact
Access tokens recorded in GitLab logs can be reused by anyone with log access to authenticate as the token owner, leading to repository, pipeline, and API compromise.

Affected Products

GitLab CE/EE versions 17.4 through 17.5.4
GitLab CE/EE versions 17.6 through 17.6.2
GitLab CE/EE version 17.7.0

Discovery Timeline

2025-01-08 - GitLab releases patch versions 17.7.1, 17.6.3, and 17.5.5
2025-01-08 - CVE-2025-0194 published to NVD
2025-07-11 - Last updated in NVD database

Technical Details for CVE-2025-0194

Vulnerability Analysis

The vulnerability stems from improper handling of sensitive credentials inside GitLab's request logging pipeline. When API requests were submitted in a specific format, the request handler failed to redact or filter access tokens before passing the request data to the logging subsystem. As a result, tokens were persisted in plaintext within production log files.

Access tokens in GitLab grant programmatic access to repositories, merge requests, CI/CD pipelines, package registries, and administrative APIs scoped to the token owner. A token captured from a log file gives the holder the same authority as the user or service account that issued the request. The attacker does not need to perform interactive authentication or solve a second factor.

Exploitation requires the attacker to already possess access to GitLab log data. This includes administrators, operations engineers, log aggregation systems, SIEM ingestion pipelines, and any third-party service receiving forwarded GitLab logs. The CVSS vector reflects this constraint with high privileges required.

Root Cause

The root cause is missing parameter filtering in the API request logging path. GitLab maintains an allow/deny list for sensitive parameters that must be scrubbed before serialization. Specific request patterns bypassed this filter, causing the private_token, access_token, or equivalent header and query parameter values to be written to disk.

Attack Vector

An attacker with read access to GitLab application logs searches for entries containing token strings. The attacker then replays these tokens against the GitLab API to enumerate projects, exfiltrate source code, modify CI/CD configurations, or pivot into connected systems. Tokens with api or write_repository scope enable supply chain attacks against downstream consumers of affected repositories.

For technical specifics, refer to the GitLab Patch Release Note and GitLab Issue #489459.

Detection Methods for CVE-2025-0194

Indicators of Compromise

Log entries in production_json.log, api_json.log, or production.log containing token-shaped strings such as glpat-, gloas-, or glptt- prefixes.
API access patterns from unexpected source IP addresses using tokens that should be scoped to internal automation.
Token usage timestamps that do not align with the legitimate owner's working hours or geography.

Detection Strategies

Grep historical GitLab log archives for known GitLab token prefixes and any matches that correspond to active, non-revoked tokens.
Correlate token authentication events in audit_json.log against the user's normal source IP and user-agent baseline to identify replay activity.
Review log forwarding destinations (SIEM, object storage, third-party aggregators) for the same token strings and treat each location as a potential exposure point.

Monitoring Recommendations

Enable GitLab audit event streaming and alert on personal access token authentications from new IP addresses or user agents.
Monitor for bulk repository clone or export operations performed via API tokens shortly after upgrade or token-rotation windows.
Track outbound API traffic from CI runners and integration accounts to detect unauthorized reuse of leaked tokens.

How to Mitigate CVE-2025-0194

Immediate Actions Required

Upgrade GitLab CE/EE to 17.7.1, 17.6.3, or 17.5.5 or later, depending on your maintenance branch.
Rotate all personal access tokens, project access tokens, group access tokens, and deploy tokens that were active on affected versions.
Audit and purge historical log files and SIEM indices that may contain exposed tokens, or restrict their access to a minimal break-glass group.
Review GitLab audit logs for suspicious token use originating from outside expected networks.

Patch Information

GitLab published fixed builds on January 8, 2025. Apply GitLab patch release 17.7.1 for the 17.7 branch, version 17.6.3 for the 17.6 branch, and version 17.5.5 for the 17.5 branch. Self-managed administrators should apply the patch through their standard package channel and verify the running version with gitlab-rake gitlab:env:info. GitLab.com SaaS tenants received the fix automatically.

Workarounds

No vendor-supplied workaround exists; upgrading is the only supported remediation.
Until patching, restrict log read access to a minimal set of administrators and disable forwarding of raw GitLab logs to third-party systems.
Shorten access token lifetimes and require re-issuance to reduce the window during which a leaked token remains valid.

bash

# Verify patched GitLab version after upgrade
sudo gitlab-rake gitlab:env:info | grep "GitLab information" -A 5

# Revoke all personal access tokens for a given user via API (admin token required)
curl --header "PRIVATE-TOKEN: <admin_token>" \
     "https://gitlab.example.com/api/v4/personal_access_tokens?user_id=<id>" \
  | jq -r '.[].id' \
  | xargs -I {} curl -X DELETE \
      --header "PRIVATE-TOKEN: <admin_token>" \
      "https://gitlab.example.com/api/v4/personal_access_tokens/{}"