CVE-2026-101168 Overview
GitLab has patched an information disclosure vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE) affecting all versions from 12.0 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. The flaw stems from insertion of sensitive request data into GitLab Pages log files and error tracking events. An authenticated user with access to GitLab Pages log data could retrieve access tokens and other secrets under certain conditions. The issue is tracked under [CWE-532: Insertion of Sensitive Information into Log File].
Critical Impact
Authenticated users with log access can obtain access tokens and secrets, enabling account impersonation and lateral movement within the GitLab environment.
Affected Products
- GitLab CE/EE versions 12.0 through 19.2.7
- GitLab CE/EE versions 19.3 through 19.3.4
- GitLab CE/EE versions 19.4 through 19.4.1
Discovery Timeline
- 2026-10-13 - CVE-2026-101168 published to NVD
- 2026-10-14 - Last updated in NVD database
Technical Details for CVE-2026-101168
Vulnerability Analysis
The vulnerability resides in the GitLab Pages component, which handles static site hosting for GitLab projects. Request data containing sensitive values such as access tokens was written into Pages log files and forwarded to error tracking events. Any authenticated user with permission to view this telemetry could extract credentials belonging to other users or system components.
Because the exposed material includes access tokens, a successful attacker can replay those tokens against GitLab APIs. This effectively bypasses authentication boundaries without triggering typical brute-force or credential-stuffing indicators. The scope change in the CVSS vector reflects that the compromise extends beyond the GitLab Pages component to resources protected by the leaked tokens.
Root Cause
The root cause is improper sanitization of request data prior to logging, categorized as [CWE-532]. The Pages service failed to redact authorization headers, query string parameters, and other secret-bearing fields before persisting them to log sinks and error tracking pipelines. This design oversight caused secrets intended for transient use to accumulate in long-lived storage.
Attack Vector
Exploitation requires an authenticated user on an adjacent network with high privileges, specifically access to GitLab Pages log data or the connected error tracking backend. The attacker queries available logs or error events, searches for authorization headers or token patterns, and reuses captured tokens against GitLab APIs. No user interaction is required, and the attack produces no integrity or availability impact on the Pages service itself.
See the GitLab Pages Work Item #1187 for technical remediation details.
Detection Methods for CVE-2026-101168
Indicators of Compromise
- Presence of Authorization: headers, bearer tokens, or private_token parameters inside GitLab Pages log files or Sentry-style error tracking events.
- API calls using valid tokens originating from unexpected IP addresses or user agents inconsistent with the token owner.
- Unusual read access patterns against log aggregation systems or error tracking dashboards from accounts that do not normally perform log review.
Detection Strategies
- Audit historical GitLab Pages logs and error tracking records for secret patterns, including JWTs, personal access tokens, and OAuth tokens.
- Correlate token usage events against the originating session and geolocation to flag reuse after log exposure.
- Review access control lists for Pages log storage and error tracking integrations to identify over-permissioned accounts.
Monitoring Recommendations
- Enable continuous scanning of log pipelines for secret regex patterns and alert on matches.
- Monitor the GitLab audit log for API token creation, revocation, and privileged action events.
- Track access to error tracking tools such as Sentry and alert on bulk event retrieval by non-SRE accounts.
How to Mitigate CVE-2026-101168
Immediate Actions Required
- Upgrade GitLab CE/EE to version 19.2.8, 19.3.5, or 19.4.2 depending on the deployed release branch.
- Rotate all access tokens, deploy tokens, CI/CD variables, and runner registration tokens that may have been written to Pages logs prior to patching.
- Restrict access to GitLab Pages log data and error tracking backends to a minimal set of trusted operators.
Patch Information
GitLab released patched versions 19.2.8, 19.3.5, and 19.4.2 that remove sensitive request data from Pages log output and error tracking submissions. Refer to the GitLab Patch Release 19.4.2 advisory for upgrade instructions and release notes.
Workarounds
- Disable or restrict GitLab Pages log forwarding to error tracking services until the patch is applied.
- Purge existing Pages log archives and error tracking events known to contain exposed secrets.
- Enforce least-privilege RBAC on log aggregation systems so that only designated SRE personnel can read Pages telemetry.
# Verify installed GitLab version and plan the upgrade path
sudo gitlab-rake gitlab:env:info | grep -i version
# Example upgrade on an Omnibus deployment (adjust package per distro)
sudo apt-get update && sudo apt-get install gitlab-ee=19.4.2-ee.0
sudo gitlab-ctl reconfigure
sudo gitlab-ctl restart
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
