CVE-2026-14351 Overview
GitLab has patched an improper authorization vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE). The flaw affects all versions from 8.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1. Under specific conditions, an unauthenticated user could view the title of a confidential issue through a publicly accessible merge request. The vulnerability is categorized as [CWE-1230] Exposure of Sensitive Information Through Metadata. It stems from missing authorization checks when rendering merge request metadata linked to confidential issues.
Critical Impact
An unauthenticated attacker with network access to a public GitLab project can read titles of confidential issues, exposing sensitive project information such as internal security work, planned features, or vulnerability tracking.
Affected Products
- GitLab CE/EE versions 8.8 through 19.0.4
- GitLab CE/EE versions 19.1 through 19.1.2
- GitLab CE/EE versions 19.2 through 19.2.0
Discovery Timeline
- 2026-07-29 - CVE-2026-14351 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-14351
Vulnerability Analysis
The vulnerability resides in how GitLab handles authorization when merge requests reference confidential issues. Confidential issues in GitLab are restricted to project members with sufficient permissions. However, when a merge request is publicly accessible and references a confidential issue, GitLab did not consistently enforce authorization on the referenced issue's title. An unauthenticated user viewing the public merge request could therefore observe the title of a confidential issue linked to it. The attack requires no user interaction and only network access to the public GitLab instance.
Root Cause
The root cause is an improper authorization check on metadata rendered within merge request views. GitLab exposes issue references, including titles, on merge request pages to convey linked work items. The rendering logic did not verify whether the requester had permission to view the confidential issue before displaying its title. This maps to [CWE-1230] Exposure of Sensitive Information Through Metadata, where sensitive data leaks through auxiliary fields rather than the primary protected object.
Attack Vector
An attacker identifies a public GitLab project containing merge requests that reference confidential issues. The attacker browses the merge request without authentication and observes the confidential issue title exposed in the linked references panel. No credentials, tokens, or privileged access are required to trigger the disclosure. The verified proof-of-concept is documented in HackerOne Report #3708242 and tracked internally in the GitLab Work Item Details.
Detection Methods for CVE-2026-14351
Indicators of Compromise
- Anomalous unauthenticated access patterns to /merge_requests/* endpoints on public projects containing confidential issues.
- Access log entries showing repeated GETs to merge request pages that reference internal confidential issue IDs.
- Web server responses returning confidential issue titles in HTML or API JSON payloads to unauthenticated sessions.
Detection Strategies
- Audit GitLab production logs (production_json.log and api_json.log) for unauthenticated requests to merge requests linked to confidential issues.
- Correlate merge request view events with the confidentiality flag on referenced issues to identify potential exposure windows.
- Review reverse proxy or load balancer access logs for high-volume scraping of merge request pages from single IP addresses.
Monitoring Recommendations
- Enable verbose GitLab audit logging for merge request and issue read operations across all projects.
- Forward GitLab logs to a SIEM and alert on unauthenticated access to endpoints tied to projects that contain confidential issues.
- Track the GitLab version banner across your fleet to confirm all self-managed instances are running a patched release.
How to Mitigate CVE-2026-14351
Immediate Actions Required
- Upgrade GitLab CE/EE self-managed instances to version 19.0.5, 19.1.3, or 19.2.1 without delay.
- Inventory public projects that contain confidential issues and review whether any referenced titles constitute sensitive disclosures.
- Rotate or rename confidential issue titles that may have been exposed if they contain sensitive keywords or identifiers.
Patch Information
GitLab has released fixed versions 19.0.5, 19.1.3, and 19.2.1. Deployment details are documented in the GitLab Release Patch Note. GitLab.com SaaS tenants are already patched by the vendor.
Workarounds
- Restrict public visibility on projects that reference confidential issues from merge requests until the upgrade is applied.
- Avoid linking confidential issues from merge requests in public projects as an interim control.
- Place GitLab behind an authenticated reverse proxy for environments where the upgrade cannot be applied immediately.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
