CVE-2026-105777: GitLab Information Disclosure Vulnerability

CVE-2026-105777 Overview

GitLab has remediated an information disclosure vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE). The flaw affects all versions from 17.6.5 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1. Under specific conditions, an unauthenticated user could retrieve sensitive internal server credentials due to improper filtering of internal response headers. The weakness is classified as [CWE-201] Insertion of Sensitive Information Into Sent Data. The issue was reported through HackerOne and tracked internally as GitLab Work Item #597022.

Critical Impact
Exposure of internal server credentials through HTTP response headers can enable follow-on attacks against internal GitLab infrastructure and connected services.

Affected Products

GitLab CE/EE versions 17.6.5 up to (but not including) 19.3.6
GitLab CE/EE versions 19.4 up to (but not including) 19.4.3
GitLab CE/EE versions 19.5 up to (but not including) 19.5.1

Discovery Timeline

2026-10-22 - CVE-2026-105777 published to NVD
2026-10-22 - Last updated in NVD database
GitLab Patch Release 19.5.1 published remediation guidance

Technical Details for CVE-2026-105777

Vulnerability Analysis

The vulnerability stems from improper filtering of internal response headers in GitLab CE/EE. When the application processes certain requests, internal headers containing sensitive server credentials are not stripped before responses reach clients. An unauthenticated requester can inspect these headers and extract credential material intended only for internal service-to-service communication.

The weakness maps to [CWE-201], where sensitive information is inserted into data sent to an unauthorized actor. The exposure is limited to confidentiality impact, with no direct effect on integrity or availability of the GitLab instance. Exploitation requires network access to the GitLab web interface but no user interaction.

Root Cause

GitLab's HTTP response pipeline failed to consistently filter internal headers before transmitting responses to external clients. Headers intended for inter-service communication within the GitLab stack were propagated outward under certain request conditions, leaking credentials that back-end components use to authenticate to internal services.

Attack Vector

The attack vector is network-based and does not require authentication under the described conditions. An attacker issues HTTP requests to a vulnerable GitLab instance and inspects response headers for leaked credential values. Captured credentials can then be reused to access internal services or pivot within the GitLab deployment.

No verified proof-of-concept code is publicly available. See the HackerOne Report #3657282 and GitLab Work Item #597022 for coordinated disclosure context.

Detection Methods for CVE-2026-105777

Indicators of Compromise

Unusual outbound HTTP responses from GitLab containing header names associated with internal service authentication tokens or credentials.
Repeated unauthenticated HEAD or GET requests from a single source enumerating endpoints and recording response headers.
Access logs showing successful use of internal service credentials from unexpected source IP ranges following GitLab request bursts.

Detection Strategies

Inspect reverse proxy and web application firewall logs for responses that include internal header names leaving the GitLab trust boundary.
Review GitLab production logs for anomalous unauthenticated access patterns targeting multiple endpoints in short time windows.
Correlate authentication events on internal services with GitLab response traffic to identify credential reuse originating from leaked header material.

Monitoring Recommendations

Enable header-level logging at the edge proxy fronting GitLab and alert on sensitive header name patterns in outbound responses.
Rotate and monitor all internal service credentials used by GitLab components, flagging unexpected authentication attempts.
Track GitLab version strings across the environment to confirm no vulnerable instances remain exposed.

How to Mitigate CVE-2026-105777

Immediate Actions Required

Upgrade GitLab CE/EE to version 19.3.6, 19.4.3, 19.5.1, or later as applicable to your release branch.
Rotate any internal service credentials that may have been transmitted through GitLab response headers prior to patching.
Audit edge proxy and load balancer logs for prior exposure of internal headers in outbound responses.

Patch Information

GitLab released fixed versions 19.3.6, 19.4.3, and 19.5.1. Refer to the GitLab Patch Release 19.5.1 advisory for the full list of patched branches, upgrade paths, and release notes. Self-managed administrators should apply the patch during their next maintenance window and verify the GitLab version after upgrade.

Workarounds

Configure the reverse proxy in front of GitLab to strip internal header names from all outbound HTTP responses until patching is complete.
Restrict unauthenticated access to the GitLab instance at the network layer where business requirements allow.
Place GitLab behind a web application firewall rule that redacts response headers matching internal credential patterns.

bash

# NGINX example: strip internal headers from GitLab responses at the proxy
proxy_hide_header X-Internal-Auth;
proxy_hide_header X-Internal-Token;
proxy_hide_header X-Service-Credential;