CVE-2026-101168 MEDIUM

CVE-2026-101168: Insertion of Sensitive Information into Log File in GitLab

Vendor Gitlab
Product GitLab
Weakness CWE-532 · Sensitive info in logs
Published October 13, 2026
Last update October 13, 2026
View on NVD All CVEs

CVSS base score

6.2/10
Attack vector Adjacent
Attack complexity Low
Privileges required High
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

What the vulnerability does

01Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.0 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with access to GitLab Pages log data to obtain access tokens and other secrets, due to insertion of sensitive request data into log files and error tracking events.

Key dates

02Disclosure timeline

October 13, 2026 CVE published

Related vulnerabilities

04Related CVE

CVE-2024-10544 Woo Manage Fraud Orders <= 2.6.1 - Unauthenticated Information Exposure via Log Files CVE-2024-31245 WordPress ConvertKit plugin <= 2.4.5 - Email Disclosure in Log File vulnerability CVE-2021-25009 CorreosExpress <= 2.6.0 - Sensitive Information Disclosure CVE-2024-25923 WordPress Community by PeepSo plugin <= 6.2.7.0 - Sensitive Data Exposure via Log File vulnerability CVE-2024-34559 WordPress Ghost plugin <= 1.4.0 - Sensitive Data Exposure via Log File vulnerability