Live › vulnerability › CVE-2026-112212
Go to dashboardGitLab CE and EE cache OAuth/OIDC discovery documents, and an unauthenticated user could poison that shared cache so certain authentication flows are sent to a server they control. That can expose login credentials or tokens to the attacker under certain conditions.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Self-managed GitLab CE and EE instances on the affected version ranges are exposed, particularly those using OAuth or OIDC sign-in with a shared cache. The sources do not specify the exact conditions beyond 'certain conditions', so teams on affected versions should treat it as relevant. Teams on GitLab.com or on versions outside the listed ranges can skip it.
No product ranges from the sources yet.
gitlab-rake gitlab:env:info or the Admin Area, and compare it to the affected ranges: 18.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1.19.3.6, 19.4.3, 19.5.1 or later, matching your release line.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, an unauthenticated user could have poisoned a shared cache's OAuth/OIDC discovery document to redirect certain flows to an externally controlled server, due to improper trust of user-supplied values when constructing endpoint URLs in cached discovery responses.
This page as .md · .json · in your agent: get_signal("CVE-2026-112212")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.