{"id":"CVE-2026-112212","kind":"vulnerability","aliases":["CVE-2026-112212"],"related":[],"title":"GitLab: poisoned OAuth discovery cache can redirect login flows externally","description":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, an unauthenticated user could have poisoned a shared cache's OAuth/OIDC discovery document to redirect certain flows to an externally controlled server, due to improper trust of user-supplied values when constructing endpoint URLs in cached discovery responses.","summary":"GitLab CE and EE cache OAuth/OIDC discovery documents, and an unauthenticated user could poison that shared cache so certain authentication flows are sent to a server they control. That can expose login credentials or tokens to the attacker under certain conditions.","severity":"high","cvss":7.5,"epss":0.0019,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gitlab","oauth","oidc","runtime","self-hosted"],"not_affected_if":["gitlab-com","unaffected-version"],"how_to_check":"- Check the installed GitLab version with `gitlab-rake gitlab:env:info` or the Admin Area, and compare it to the affected ranges: 18.3 before `19.3.6`, 19.4 before `19.4.3`, and 19.5 before `19.5.1`.\n- Check whether OAuth or OIDC sign-in is enabled in the GitLab configuration.","fix":"- Upgrade GitLab CE/EE to `19.3.6`, `19.4.3`, `19.5.1` or later, matching your release line.","status":"open","published_at":"2026-10-22T01:16:57+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T03:16:19+00:00","updated_at":"2026-10-25T03:16:19+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T03:16:19Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade GitLab CE/EE to `19.3.6`, `19.4.3`, `19.5.1` or later, matching your release line.","reach":"network","title":"GitLab: poisoned OAuth discovery cache can redirect login flows externally","impact":"high","summary":"GitLab CE and EE cache OAuth/OIDC discovery documents, and an unauthenticated user could poison that shared cache so certain authentication flows are sent to a server they control. That can expose login credentials or tokens to the attacker under certain conditions.","category":"runtime","nicknames":[],"who_cares":["gitlab","self-hosted","oauth","oidc"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker redirects login flows to a server they control, capturing credentials","analyst_note":"Confirm the exact preconditions for the cache poisoning and which OAuth/OIDC flows are redirected, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-112212 and GitLab's release notes.","how_to_check":"- Check the installed GitLab version with `gitlab-rake gitlab:env:info` or the Admin Area, and compare it to the affected ranges: 18.3 before `19.3.6`, 19.4 before `19.4.3`, and 19.5 before `19.5.1`.\n- Check whether OAuth or OIDC sign-in is enabled in the GitLab configuration.","needs_analyst":true,"not_affected_if":["gitlab-com","unaffected-version"],"who_is_affected":"Self-managed GitLab CE and EE instances on the affected version ranges are exposed, particularly those using OAuth or OIDC sign-in with a shared cache. The sources do not specify the exact conditions beyond 'certain conditions', so teams on affected versions should treat it as relevant. Teams on GitLab.com or on versions outside the listed ranges can skip it.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000695,"input_tokens":3434,"output_tokens":704,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-112212':13A,16A '-2026':12A,15A '18.3':77C '19.3.6':79C '19.4':80C '19.4.3':82C '19.5':84C '19.5.1':86C 'affect':73C 'attack':61B 'authent':43B 'cach':5A,28B,40B,99C,127C 'ce':25B 'ce/ee':72C 'certain':42B,63B,89C,106C 'condit':64B,90C 'construct':123C 'control':51B,111C 'could':36B,94C 'credenti':56B 'cve':11A,14A 'discoveri':4A,30B,102C,128C 'document':31B,103C 'due':113C 'ee':27B 'endpoint':124C 'expos':54B 'extern':10A,110C 'flow':9A,44B,107C 'gitlab':1A,17B,24B,65C,71C 'host':23B 'improp':115C 'issu':69C 'login':8A,55B 'oauth':3A,18B 'oauth/oidc':29B,101C 'oidc':19B 'poison':2A,37B,96C 'redirect':7A,105C 'remedi':67C 'respons':129C 'runtim':20B 'self':22B 'self-host':21B 'sent':46B 'server':49B,112C 'share':39B,98C 'suppli':120C 'token':58B 'trust':116C 'unauthent':34B,92C 'url':125C 'user':35B,93C,119C 'user-suppli':118C 'valu':121C 'version':75C","nicknames":[],"mitigations":[],"who_affected":"Self-managed GitLab CE and EE instances on the affected version ranges are exposed, particularly those using OAuth or OIDC sign-in with a shared cache. The sources do not specify the exact conditions beyond 'certain conditions', so teams on affected versions should treat it as relevant. Teams on GitLab.com or on versions outside the listed ranges can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T01:16:57+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:L","cvss_by":"cve@gitlab.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112212","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112212","severity":null,"published_at":"2026-10-22T01:16:57+00:00","modified_at":"2026-10-22T16:18:19+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-112212","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112212","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-24T07:15:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}