Live › vulnerability › CVE-2026-105777
Go to dashboardGitLab CE and EE pass certain internal response headers through without filtering, so under specific conditions an unauthenticated user can read sensitive internal server credentials. The sources say the flaw affects GitLab from 17.6.5 up to the fixed releases 19.3.6, 19.4.3 and 19.5.1.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Self-hosted GitLab CE or EE instances running versions from before the fixed releases. The sources do not say which configurations trigger the conditions, so teams should assume their instance may be exposed until patched. Gitlab.com managed hosting is not stated in the sources as affected or unaffected.
17.6.5No product ranges from the sources yet.
Unknown from the sources.
19.3.6, 19.4.3 or 19.5.1 depending on the release branch in use.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6.5 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, an unauthenticated user could have retrieved sensitive internal server credentials due to improper filtering of internal response headers.
This page as .md · .json · in your agent: get_signal("CVE-2026-105777")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.