CVE-2026-105711: GitLab Information Disclosure Vulnerability

CVE-2026-105711 Overview

CVE-2026-105711 is an information disclosure vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE). When a merge request in a public project references a confidential issue from a private project, an authenticated user without project membership can read the confidential issue's title. The root cause is a viewer-independent fragment cache key that shares per-user-redacted rendered content across all users. The flaw is tracked under CWE-524 (Use of Cache Containing Sensitive Information).

Critical Impact
Authenticated users with no project membership can read titles of confidential issues referenced from merge requests in public projects, leaking information intended to remain private.

Affected Products

GitLab CE/EE versions 15.0 through 19.3.6 (prior to 19.3.6)
GitLab CE/EE versions 19.4 before 19.4.3
GitLab CE/EE versions 19.5 before 19.5.1

Discovery Timeline

2026-10-22 - CVE-2026-105711 published to the National Vulnerability Database (NVD)
2026-10-22 - Last updated in NVD database

Technical Details for CVE-2026-105711

Vulnerability Analysis

The vulnerability resides in GitLab's rendered content caching layer. GitLab caches rendered Markdown fragments to improve performance when displaying merge requests and issue references. The caching mechanism applies per-user redaction after rendering, so confidential references appear as redacted placeholders for users who lack permission to view them.

The fragment cache key used for merge request descriptions did not include a viewer-specific component. The cached, already-redacted content from one user's view was reused when serving the same fragment to other users. If the first viewer had permission to see the referenced confidential issue, the rendered fragment stored in cache contained the real issue title. Subsequent authenticated users without permission then received that cached fragment, exposing the title.

Successful exploitation requires an authenticated account and user interaction to visit the affected merge request. The disclosure is limited to the confidential issue's title; issue body, comments, and other metadata are not exposed through this cache path.

Root Cause

The cache key omitted viewer identity and permission context. GitLab's per-user redaction logic assumes each user receives a distinct rendering pass, but the shared fragment cache violated that assumption. This maps to CWE-524, where a cache contains sensitive information accessible to unauthorized parties.

Attack Vector

An attacker authenticates to a GitLab instance and locates a public project whose merge request references a confidential issue from a private project. The attacker opens the merge request. If a privileged user has previously rendered that merge request and populated the fragment cache, the attacker's browser receives the cached fragment containing the confidential issue title.

No code execution or privilege escalation occurs. The attack produces read-only disclosure of a single field per cached fragment. See the GitLab Patch Release Note and GitLab Work Item #632207 for upstream analysis.

Detection Methods for CVE-2026-105711

Indicators of Compromise

Unexpected authenticated requests to merge request pages in public projects that reference issues from private projects the requesting user does not belong to.
Access patterns where non-member users repeatedly fetch merge request descriptions shortly after a privileged user viewed the same resource.
Enumeration-style traversal of public project merge requests by low-privilege accounts.

Detection Strategies

Review GitLab production logs (production_json.log and api_json.log) for authenticated GET requests to merge request endpoints by users with no membership in the referenced private project.
Correlate cache hits for merge request fragment renderings against the viewing user's project permissions to identify disclosure windows.
Audit which users have accessed merge requests known to reference confidential issues since GitLab version 15.0 was deployed.

Monitoring Recommendations

Enable detailed audit logging for merge request views and alert on bursts of access by non-members.
Track GitLab version and patch level across self-managed instances to confirm remediation coverage.
Monitor the HackerOne Report #3963293 disclosure thread for any additional technical detail that could inform detection rules.

How to Mitigate CVE-2026-105711

Immediate Actions Required

Upgrade self-managed GitLab CE/EE to version 19.5.1, 19.4.3, or 19.3.6, whichever matches your release stream.
Inventory public projects whose merge requests reference confidential issues from private projects and assess potential exposure.
Rotate or redact any confidential issue titles that may have been disclosed if sensitive information was embedded in them.

Patch Information

GitLab remediated the issue by introducing a viewer-aware fragment cache key so that per-user-redacted content is no longer shared across users. Patched builds are available in GitLab CE/EE 19.3.6, 19.4.3, and 19.5.1. See the GitLab Patch Release Note for the full release manifest and upgrade guidance.

Workarounds

Avoid referencing confidential issues from private projects inside merge requests that reside in public projects until patching is complete.
Restrict public project visibility temporarily if sensitive cross-project references cannot be removed quickly.
Clear the GitLab Rails cache after upgrading to evict any pre-patch cached fragments: run gitlab-rails cache:clear on self-managed instances.

bash

# Upgrade example for an Omnibus GitLab installation on Debian/Ubuntu
sudo apt-get update
sudo apt-get install gitlab-ee=19.5.1-ee.0
sudo gitlab-ctl reconfigure
sudo gitlab-rails cache:clear