Acceptance of Extraneous Untrusted Data With Trusted Data in GitLab Enterprise Edition and Gitlab Community Edition - CVE-2026-112212
Published: October 22, 2026
Vulnerability identifier: #VU157240
CSH Severity: Medium
CVSS v4: 5.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-112212
CWE-ID: CWE-349
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to poison cached OAuth/OIDC discovery documents and redirect certain flows to an externally controlled server.
The vulnerability exists due to improper trust of user-supplied values in OAuth/OIDC discovery endpoints when constructing endpoint URLs in cached discovery responses. A remote attacker can supply crafted values to poison a shared discovery document and redirect affected flows to an externally controlled server when users consume the poisoned document.
Affected software
GitLab Enterprise Edition
Gitlab Community Edition
Gitlab Community Edition
How to mitigate CVE-2026-112212
Install security update from vendor's website.
GitLab Enterprise Edition - addressed in versions 19.3.6, 19.4.3, 19.5.1
Gitlab Community Edition - addressed in versions 19.3.6, 19.4.3, 19.5.1
Gitlab Community Edition - addressed in versions 19.3.6, 19.4.3, 19.5.1