Inclusion of Sensitive Information in Log Files in GitLab Enterprise Edition and Gitlab Community Edition - CVE-2026-101168
Published: October 13, 2026
Vulnerability identifier: #VU154155
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-101168
CWE-ID: CWE-532
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote privileged user to obtain access tokens and other secrets.
The vulnerability exists due to insertion of sensitive request data into log files and error tracking events in GitLab Pages when logging requests and recording errors. A remote privileged user can read GitLab Pages log data to obtain access tokens and other secrets.
Exploitation requires access to GitLab Pages log data and an adjacent-network attack position.
Affected software
GitLab Enterprise Edition
Gitlab Community Edition
Gitlab Community Edition
How to mitigate CVE-2026-101168
Install security update from vendor's website.
GitLab Enterprise Edition - addressed in versions 19.2.8, 19.3.4, 19.4.2
Gitlab Community Edition - addressed in versions 19.2.8, 19.3.4, 19.4.2
Gitlab Community Edition - addressed in versions 19.2.8, 19.3.4, 19.4.2