CVE-2026-101168

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-101168
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-101168.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-101168
Aliases
Downstream
CGA (168)
MINI (51)
UBUNTU (1)
Published
2026-10-13T01:05:21Z
Modified
2026-10-30T10:47:16Z
Severity
  • 6.2 (Medium) CVSS_V3 - CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N CVSS Calculator
Summary
Insertion of Sensitive Information into Log File in GitLab
Details

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.0 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with access to GitLab Pages log data to obtain access tokens and other secrets, due to insertion of sensitive request data into log files and error tracking events.

Database specific 
{
    "cna_assigner": "GitLab",
    "cwe_ids": [
        "CWE-532"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101168.json"
}
References

Affected packages

Git / gitlab.com/gitlab-org/gitlab

Affected ranges

Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
3b13818e8330f68625d80d9bf5d8049c41fbe197
Fixed
9a42f777a0147768457ebe684e13e69d54eee652
Introduced
8f83039bebbbb61d3b7b8b7e2342d1deec1e14c6
Fixed
ce7cbf1bcc4e49e98f209097d5081030e30410c5
Introduced
fa703f93afaf1133cd263f6aa0e91d284d7f1ebf
Fixed
9c053f678a4924425869b1b9e4bca3a44e45edf7
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
            "range": [
                {
                    "introduced": "12.0.0"
                },
                {
                    "fixed": "19.2.8"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
            "range": [
                {
                    "introduced": "12.0.0"
                },
                {
                    "fixed": "19.2.8"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
            "range": [
                {
                    "introduced": "19.3.0"
                },
                {
                    "fixed": "19.3.5"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
            "range": [
                {
                    "introduced": "19.3.0"
                },
                {
                    "fixed": "19.3.5"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
            "range": [
                {
                    "introduced": "19.4.0"
                },
                {
                    "fixed": "19.4.2"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
            "range": [
                {
                    "introduced": "19.4.0"
                },
                {
                    "fixed": "19.4.2"
                }
            ],
            "source": "CPE_RANGE"
        }
    ]
}

Affected versions

v19.*
v19.3.0-ee
v19.4.0-ee

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-101168.json"