---
id: "CVE-2026-105777"
kind: "vulnerability"
aliases: ["CVE-2026-105777"]
title: "GitLab CE/EE: unauthenticated users could retrieve internal server credentials via headers"
severity: "medium"
cvss: 4.3
epss: 0.0025
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["gitlab", "package", "self-hosted"]
not_affected_if: ["managed-hosting"]
published_at: "2026-10-22T01:16:57+00:00"
first_seen_at: "2026-10-23T21:57:29+00:00"
updated_at: "2026-10-25T04:37:33+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105777", "first_seen_at": "2026-10-23T21:57:29+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-105777", "first_seen_at": "2026-10-24T07:15:52+00:00"}]
---

# GitLab CE/EE: unauthenticated users could retrieve internal server credentials via headers

GitLab CE and EE pass certain internal response headers through without filtering, so under specific conditions an unauthenticated user can read sensitive internal server credentials. The sources say the flaw affects GitLab from 17.6.5 up to the fixed releases 19.3.6, 19.4.3 and 19.5.1.

_Summary, check and fix written by a model from the sources; labelled as such._

## Fix

- Upgrade GitLab CE/EE to `19.3.6`, `19.4.3` or `19.5.1` depending on the release branch in use.

## Timeline

- 2026-10-23T21:57:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-105777
- 2026-10-24T07:15:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-105777

## From the sources

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6.5 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, an unauthenticated user could have retrieved sensitive internal server credentials due to improper filtering of internal response headers.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_