Use of cache containing sensitive information in GitLab Enterprise Edition and Gitlab Community Edition - CVE-2026-105711

Vulnerability details

The vulnerability allows a remote user to read a confidential issue's title without membership in the private project containing the issue.

The vulnerability exists due to use of a cache containing sensitive information in merge request title rendering when a public project's merge request references a confidential issue in a private project. A remote user can view the affected merge request after rendered content has been cached to read the confidential issue's title because a viewer-independent fragment cache key shares per-user-redacted content across users.

Affected software

How to mitigate CVE-2026-105711

External References

• https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/
• https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/#cve-2026-105711---use-of-cache-containing-sensitive-information-issue-in-merge-request-title-rendering-impacts-gitlab-ceee

Related Security Bulletins

• Multiple vulnerabilities in GitLab CE/EE