CVE-2026-4523: GitLab GraphQL API Information Disclosure

CVE-2026-4523 Overview

GitLab patched an authorization flaw in GitLab Community Edition (CE) and Enterprise Edition (EE) that could expose Continuous Integration/Continuous Deployment (CI/CD) job trace contents to unauthenticated users. The issue affects all versions from 15.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1. Under specific conditions, an unauthenticated actor could query the GraphQL API and read job trace data containing sensitive variable values. The root cause is improper authorization enforcement, tracked under [CWE-862]. GitLab addressed the issue in patch release 19.4.1.

Critical Impact
Unauthenticated network attackers could retrieve CI/CD job trace contents, potentially disclosing secrets, tokens, and pipeline variables handled by GitLab runners.

Affected Products

GitLab CE/EE versions 15.11 through 19.2.6
GitLab CE/EE versions 19.3 through 19.3.2
GitLab CE/EE version 19.4 (before 19.4.1)

Discovery Timeline

2026-09-29 - CVE-2026-4523 published to the National Vulnerability Database (NVD)
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-4523

Vulnerability Analysis

The vulnerability resides in the GitLab GraphQL API layer, which serves as the primary programmatic interface for GitLab resources. A specific GraphQL query path returning CI/CD job trace data did not enforce authorization checks consistently. As a result, requests originating from unauthenticated sessions could reach protected resolver logic and return trace contents. Job traces frequently include command output, environment context, and echoed variable values from pipeline execution. Where projects log or reference sensitive CI/CD variables, attackers could harvest credentials, deployment tokens, or configuration data. Exploitation depends on specific conditions being present, which is reflected in the high attack complexity rating.

Root Cause

The defect is a missing authorization check, classified as [CWE-862] Missing Authorization. The GraphQL resolver responsible for returning job trace contents did not verify that the requesting principal held the required project or job-level permissions before returning data. Confidentiality controls that apply to the equivalent REST endpoint were not consistently mirrored in the GraphQL path.

Attack Vector

The attack is network-based and requires no privileges or user interaction. An attacker crafts a GraphQL query targeting job trace fields on a vulnerable GitLab instance. When the conditions required to trigger the flaw are met, the server returns trace output associated with CI/CD jobs. See GitLab Work Item #594294 and HackerOne Report #3590929 for technical context.

// No verified proof-of-concept code is published. The flaw is triggered by
// unauthenticated GraphQL queries against job trace fields on affected GitLab versions.

Detection Methods for CVE-2026-4523

Indicators of Compromise

Unauthenticated or anonymous requests to the /api/graphql endpoint querying job or trace-related fields.
Bursts of GraphQL queries from a single source IP referencing ciJob, trace, or jobs selectors.
Access log entries returning HTTP 200 responses for job trace queries without an associated authenticated session token.

Detection Strategies

Enable GitLab structured production logs and forward production_json.log and graphql_json.log to a central analytics platform for anomaly review.
Alert on unauthenticated GraphQL requests that include job-trace field selectors, particularly from external networks.
Baseline normal GraphQL API usage per project and flag deviations in query shape or volume that involve CI/CD job data.

Monitoring Recommendations

Monitor CI/CD variable rotation events and correlate them with anomalous GraphQL activity preceding the rotation.
Track outbound authentication events using tokens or secrets that may have appeared in job traces on the vulnerable instance.
Review web application firewall (WAF) telemetry for POST requests to /api/graphql lacking valid session or personal access token headers.

How to Mitigate CVE-2026-4523

Immediate Actions Required

Upgrade GitLab CE/EE to version 19.4.1, 19.3.3, or 19.2.7 as applicable to the deployed release stream.
Rotate any CI/CD variables, deployment tokens, or secrets that may have been echoed to job traces on the affected instance.
Audit GraphQL access logs for unauthenticated queries against job or trace fields since the earliest affected release.

Patch Information

GitLab addressed CVE-2026-4523 in patch release 19.4.1, with backports available in 19.3.3 and 19.2.7. Refer to the GitLab Patch Release 19.4.1 advisory for release notes and upgrade instructions. Self-managed operators should apply the patch through their standard package manager or Helm chart update process.

Workarounds

Restrict network access to the GitLab instance so that the /api/graphql endpoint is not reachable from untrusted networks until patching is complete.
Configure a reverse proxy or WAF rule to block anonymous POST requests to /api/graphql that reference job trace fields.
Mark CI/CD variables as masked and protected and avoid echoing secrets in pipeline scripts to reduce residual exposure.

bash

# Example: block unauthenticated GraphQL job trace queries at an NGINX reverse proxy
location /api/graphql {
    if ($http_authorization = "") {
        return 403;
    }
    proxy_pass http://gitlab_upstream;
}