{"id":"CVE-2026-105777","kind":"vulnerability","aliases":["CVE-2026-105777"],"related":[],"title":"GitLab CE/EE: unauthenticated users could retrieve internal server credentials via headers","description":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6.5 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, an unauthenticated user could have retrieved sensitive internal server credentials due to improper filtering of internal response headers.","summary":"GitLab CE and EE pass certain internal response headers through without filtering, so under specific conditions an unauthenticated user can read sensitive internal server credentials. The sources say the flaw affects GitLab from 17.6.5 up to the fixed releases 19.3.6, 19.4.3 and 19.5.1.","severity":"medium","cvss":4.3,"epss":0.0025,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gitlab","package","self-hosted"],"not_affected_if":["managed-hosting"],"how_to_check":null,"fix":"- Upgrade GitLab CE/EE to `19.3.6`, `19.4.3` or `19.5.1` depending on the release branch in use.","status":"open","published_at":"2026-10-22T01:16:57+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T04:37:33+00:00","updated_at":"2026-10-25T04:37:33+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:37:33Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade GitLab CE/EE to `19.3.6`, `19.4.3` or `19.5.1` depending on the release branch in use.","reach":"internet","title":"GitLab CE/EE: unauthenticated users could retrieve internal server credentials via headers","impact":"medium","summary":"GitLab CE and EE pass certain internal response headers through without filtering, so under specific conditions an unauthenticated user can read sensitive internal server credentials. The sources say the flaw affects GitLab from 17.6.5 up to the fixed releases 19.3.6, 19.4.3 and 19.5.1.","category":"package","nicknames":[],"who_cares":["gitlab","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Unauthenticated attacker reads internal server credentials under certain conditions","analyst_note":"Check the GitLab release notes and advisory for the exact trigger conditions and which credentials are exposed; the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-105777 gives only the summary.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting"],"who_is_affected":"Self-hosted GitLab CE or EE instances running versions from `17.6.5` before the fixed releases. The sources do not say which configurations trigger the conditions, so teams should assume their instance may be exposed until patched. Gitlab.com managed hosting is not stated in the sources as affected or unaffected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000622,"input_tokens":3394,"output_tokens":565,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-105777':14A,17A '-2026':13A,16A '17.6.5':56B,78C '19.3.6':62B,80C '19.4':81C '19.4.3':63B,83C '19.5':85C '19.5.1':65B,87C 'affect':53B,74C 'ce':24B 'ce/ee':2A,73C 'certain':28B,90C 'condit':38B,91C 'could':5A,95C 'credenti':9A,47B,101C 'cve':12A,15A 'due':102C 'ee':26B 'filter':34B,105C 'fix':60B 'flaw':52B 'gitlab':1A,18B,23B,54B,66C,72C 'header':11A,31B,109C 'host':22B 'improp':104C 'intern':7A,29B,45B,99C,107C 'issu':70C 'packag':19B 'pass':27B 'read':43B 'releas':61B 'remedi':68C 'respons':30B,108C 'retriev':6A,97C 'say':50B 'self':21B 'self-host':20B 'sensit':44B,98C 'server':8A,46B,100C 'sourc':49B 'specif':37B 'unauthent':3A,40B,93C 'user':4A,41B,94C 'version':76C 'via':10A 'without':33B","nicknames":[],"mitigations":[],"who_affected":"Self-hosted GitLab CE or EE instances running versions from `17.6.5` before the fixed releases. The sources do not say which configurations trigger the conditions, so teams should assume their instance may be exposed until patched. Gitlab.com managed hosting is not stated in the sources as affected or unaffected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T01:16:57+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"cve@gitlab.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105777","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105777","severity":null,"published_at":"2026-10-22T01:16:57+00:00","modified_at":"2026-10-22T16:18:19+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-105777","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105777","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-24T07:15:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}