Description
GitLab has remediated an issue in GitLab EE affecting all versions from 18.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed some sensitive information to be disclosed to an unintended host due to improper handling of upstream requests in virtual registries.
References (2)
Core 2
Scores
CVSS v3
5.4
EPSS
0.0025
EPSS Percentile
16.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-522
Status
published
Products (3)
GitLab/GitLab
18.8 - 19.0.5
GitLab/GitLab
19.1 - 19.1.3
GitLab/GitLab
19.2 - 19.2.1
Published
Jul 29, 2026
Tracked Since
Jul 30, 2026