CVE-2026-11379 Overview
CVE-2026-11379 is an incorrect authorization vulnerability in GitLab Enterprise Edition (EE) affecting the Dynamic Application Security Testing (DAST) site profile management feature. The flaw allows a user holding the Developer role to exfiltrate DAST site profile secrets under certain conditions. The issue impacts all GitLab EE versions from 13.11 prior to 18.11.6, 19.0 prior to 19.0.3, and 19.1 prior to 19.1.1. The weakness is categorized as [CWE-863] Incorrect Authorization. GitLab has remediated the issue in the corresponding patch releases.
Critical Impact
A low-privileged Developer-role user can disclose sensitive DAST site profile secrets, exposing credentials used for application security scans.
Affected Products
- GitLab EE versions 13.11 through 18.11.5
- GitLab EE versions 19.0 through 19.0.2
- GitLab EE versions 19.1 through 19.1.0
Discovery Timeline
- 2026-06-25 - CVE-2026-11379 published to NVD
- 2026-06-25 - Last updated in NVD database
Technical Details for CVE-2026-11379
Vulnerability Analysis
The vulnerability resides in the DAST site profile management component of GitLab EE. DAST site profiles store configuration data used to scan target applications, including authentication secrets required to access protected endpoints. The application fails to correctly enforce authorization checks when a user attempts to read these secrets through specific workflows. A user assigned the Developer role, which should be restricted from viewing sensitive scanner credentials, can retrieve them under certain conditions. Exploitation requires network access to the GitLab instance and an authenticated low-privileged account.
Root Cause
The root cause is an incorrect authorization check [CWE-863] in the DAST site profile management logic. Permission validation does not properly restrict access to secret fields based on the requesting user's role. The application returns secret material to callers whose effective permissions should not permit reading it.
Attack Vector
The attack vector is network-based and requires authenticated access with at least Developer-level permissions on a project that contains DAST site profiles. The attacker triggers the affected DAST site profile management workflow and receives the protected secret values in the response. No user interaction is required. Successful exploitation results in disclosure of credentials that may be reused against the targeted scan targets or pivoted into broader access. See the GitLab Work Item Overview for additional technical context.
Detection Methods for CVE-2026-11379
Indicators of Compromise
- Unexpected access to DAST site profile endpoints from accounts holding only the Developer role.
- Audit log entries showing DAST site profile read operations followed by reuse of associated credentials from unusual source addresses.
- Anomalous GraphQL or REST API queries against DAST configuration resources outside of normal CI/CD pipeline activity.
Detection Strategies
- Review GitLab audit events for DAST site profile reads attributed to users without Maintainer or Owner roles.
- Correlate API access logs with project membership data to identify role-to-action mismatches against DAST resources.
- Hunt for credential reuse patterns where DAST profile secrets appear in authentication attempts to scan target systems.
Monitoring Recommendations
- Enable and forward GitLab audit logs and application logs to a centralized analytics platform for retention and search.
- Alert on bulk enumeration of DAST site profiles across multiple projects within short time windows.
- Monitor for outbound use of DAST-configured credentials originating from sources other than authorized runners.
How to Mitigate CVE-2026-11379
Immediate Actions Required
- Upgrade GitLab EE to version 18.11.6, 19.0.3, or 19.1.1 or later, depending on the deployed release branch.
- Audit existing DAST site profiles and rotate any secrets that may have been accessible to Developer-role users.
- Review project membership and reduce Developer-role assignments where they are not required.
Patch Information
GitLab released fixed versions 18.11.6, 19.0.3, and 19.1.1 that address the incorrect authorization in DAST site profile management. Patch details are documented in the GitLab Release Patch Note. Self-managed administrators should apply the patch corresponding to their current major.minor release line.
Workarounds
- Restrict Developer-role assignments on projects that contain DAST site profiles until the patch is applied.
- Remove or replace stored secrets in DAST site profiles with short-lived credentials that can be rotated frequently.
- Limit network exposure of the GitLab instance to trusted users and CI/CD infrastructure to reduce the attacker pool.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
