GitLab has a vulnerability that improperly encodes or escapes output, enabling an authenticated user with maintainer-role permissions to reveal Datadog API credentials under certain conditions. This leads to disclosure of sensitive credentials, a confidentiality compromise. The weakness is classified as CWE-116. The vendor explicitly states that "an authenticated user with maintainer‑role permissions could reveal Datadog API credentials".

Affected are all GitLab Community Edition (CE) and Enterprise Edition (EE) versions from 15.5 up to, but not including, 18.7.6, from 18.8 up to, but not including, 18.8.6, and from 18.9 up to, but not including, 18.9.2.

The CVSS score of 2.2 indicates low severity, while the EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires legitimate maintainer access to a project; an attacker would need to be an authenticated user with maintainer rights to access the compromised output that reveals the credentials. No publicly documented exploits exist, but the low severity does not diminish the need for timely remediation.