p PatchFirst

CVE-2026-101168

CVE-2026-101168 · Insertion of Sensitive Information into Log File in GitLab

This page contains facts from public vulnerability sources. Check the original advisory before updating.

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.0 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with access to GitLab Pages log data to obtain access tokens and other secrets, due to insertion of sensitive request data into log files and error tracking events.

CVSS 6.2 · Medium · EPSS 0.2% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • gitlab

    Versions
    • ≥ 12.0, < 19.2.8: Affected (semver)
    • ≥ 19.3, < 19.3.5: Affected (semver)
    • ≥ 19.4, < 19.4.2: Affected (semver)

    Update to 19.2.8; Update to 19.3.5; Update to 19.4.2

  • gitlab Ubuntu:16.04:LTS

    Versions
    • 8.4.3+dfsg-9
    • 8.4.3+dfsg-12
    • 8.5.8+dfsg-5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →