CVE-2026-112378 Overview
CVE-2026-112378 is a business logic flaw in GitLab Enterprise Edition (EE) that allows authenticated users to access paid artificial intelligence (AI) features without a valid subscription. The vulnerability stems from insufficient server-side validation in billing eligibility checks. It affects GitLab EE versions 17.8 through 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1. GitLab tracks the underlying issue as internal work item 634027 and shipped the fix in patch release 19.5.1. The flaw is categorized under CWE-348: Use of Less Trusted Source and requires low-privilege authentication over the network.
Critical Impact
Authenticated users can bypass subscription enforcement to consume paid GitLab Duo AI features, resulting in revenue loss and policy violations for affected instances.
Affected Products
- GitLab EE 17.8 through 19.3.5
- GitLab EE 19.4 before 19.4.3
- GitLab EE 19.5 before 19.5.1
Discovery Timeline
- 2026-10-22 - CVE-2026-112378 published to NVD
- 2026-10-22 - Last updated in NVD database
Technical Details for CVE-2026-112378
Vulnerability Analysis
The vulnerability resides in the billing eligibility checks that gate access to GitLab Duo and other paid AI features in GitLab EE. The server trusts client-supplied or weakly validated context when deciding whether a user is entitled to invoke an AI feature. An authenticated user with any role can trigger paid AI functionality that should remain locked behind the subscription tier.
Because the control gap is in authorization logic rather than input sanitization, exploitation does not require malformed payloads. The attacker simply exercises the AI feature endpoints under conditions the server fails to re-verify. Confidentiality is not impacted, but integrity of billing enforcement is directly undermined.
Root Cause
The root cause is incomplete server-side validation of subscription state when AI feature requests reach GitLab EE. The design maps to CWE-348, where the application relies on a source of entitlement data that an authenticated user can influence. GitLab EE did not consistently re-check billing eligibility at the service boundary before authorizing paid AI operations.
Attack Vector
Exploitation requires network access to a vulnerable GitLab EE instance and a valid authenticated session. No user interaction is needed, and attack complexity is low. The attacker invokes AI feature calls that the backend should block for non-subscribed users. The vendor describes the issue as conditional, meaning specific tenant or group configurations must be present for the bypass to succeed.
No verified public exploit code is available. See the GitLab Patch Release 19.5.1 advisory and GitLab Work Item #634027 for vendor technical context.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-112378
Indicators of Compromise
- Unexpected invocations of GitLab Duo or other paid AI endpoints originating from user accounts that are not assigned a paid seat.
- AI feature usage counters in GitLab admin telemetry that exceed the number of licensed seats on the instance.
- Billing or entitlement log entries that record eligibility_check=false immediately followed by a successful AI feature response.
Detection Strategies
- Correlate GitLab application logs for AI feature endpoints against the subscription seat assignments and alert on mismatches.
- Review audit events for authenticated users invoking Duo chat, code suggestions, or related AI APIs under namespaces lacking paid entitlement.
- Baseline normal AI API call volume per user and investigate spikes that deviate from licensed usage patterns.
Monitoring Recommendations
- Forward GitLab production logs and audit events into a centralized analytics platform for continuous eligibility-vs-usage correlation.
- Enable GitLab's admin usage dashboards for Duo and reconcile reported consumption with billing records on a regular cadence.
- Track authenticated API calls to AI feature routes by user, namespace, and subscription tier to surface policy drift early.
How to Mitigate CVE-2026-112378
Immediate Actions Required
- Upgrade GitLab EE to 19.5.1, 19.4.3, or 19.3.6, matching the branch currently deployed.
- Audit AI feature usage since the vulnerable versions were deployed to identify users who accessed paid functionality without entitlement.
- Revoke or rotate tokens for accounts observed abusing AI endpoints while the instance was unpatched.
Patch Information
GitLab remediated the issue in patch release 19.5.1 and backported fixes to the 19.4.x and 19.3.x branches. Administrators should apply the vendor update documented in the GitLab Patch Release 19.5.1 notes. The underlying code change is tracked in GitLab Work Item #634027.
Workarounds
- Disable GitLab Duo and other paid AI features at the instance or top-level group scope until the patch is applied.
- Restrict authenticated API access to AI feature routes using a reverse proxy or web application firewall rule set.
- Limit account creation and tighten role assignments to reduce the authenticated user population that could reach the vulnerable endpoints.
# Example: disable GitLab Duo features at the instance level via Rails console
sudo gitlab-rails runner "Ai::Setting.instance.update!(duo_features_enabled: false)"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
