CVE-2026-105777: GitLab 17.6.5 to before 19.3.6, 19.4 to before 19.4.3, 19.5 to before 19.5.1

Affected technology

GitLab · 17.6.5 to before 19.3.6, 19.4 to before 19.4.3, 19.5 to before 19.5.1
GitLab

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

The source says gitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6.5 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, an unauthenticated user could have retrieved sensitive internal server credentials due to improper filtering of internal response headers. Vendor/CNA’s CVSS 3.1 assessment (base score 4.3/10) rates confidentiality impact as low; integrity and availability impact as none.