CVE-2026-105777: GitLab CE/EE internal credential exposure in internal response headers

The flaw is improper filtering of internal response headers. Headers meant for GitLab's own components, such as those between its web service and the proxy in front of it, can reach the client, and they carry internal server credentials. GitLab does not say which headers leak or which conditions are needed.

The bulletin's text says an unauthenticated user could retrieve the credentials, but the CVSS 3.1 vector lists privileges required as low, with low confidentiality impact and no integrity or availability impact. GitLab does not explain the difference. Treat the instance as reachable by anyone who can send it requests.

What the attacker does with the credentials depends on what they unlock, and the bulletin does not say. Because the impact is rated low confidentiality, GitLab treats it as limited disclosure rather than takeover. GitLab credits the reporter altair00 via HackerOne and does not report exploitation.

Self-managed GitLab CE and EE, all versions from 17.6.5 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1. GitLab.com is already patched. GitLab Dedicated tenants on 19.3.5-internal0 or 19.4.2-internal0 and later include the fix.

The version appears on the Help page (/help) when signed in, in the Admin Area, and in the bulletin's linked "Find your GitLab version" page. On an Omnibus install the package manager also shows it:

dpkg -l gitlab-ee gitlab-ce

Upgrade to GitLab 19.5.1, 19.4.3 or 19.3.6, depending on your release line. The same patch release also ships 19.0.10, 19.1.9, 19.2.9 and 18.11.13 for older lines in the affected range; confirm in the release page that your line is covered. GitLab lists no workaround and says only to upgrade.

After patching, consider rotating internal credentials that could have been exposed, since the bulletin does not say what was leaked. Check the GitLab update guide for upgrade paths between your current version and the target.

The bulletin gives no log signature. Review web server and proxy access logs for unusual unauthenticated or low-privilege requests, and for responses that carry unexpected internal headers. Rotate internal tokens and secrets after upgrading if the instance was reachable by untrusted users before the patch.

Under certain conditions, an unauthenticated user could have retrieved sensitive internal server credentials due to improper filtering of internal response headers. Impacted versions: GitLab CE/EE all versions from 17.6.5 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1. Fixed in GitLab CE/EE 19.5.1, 19.4.3 and 19.3.6, released October 21, 2026.