An attacker may obtain sensitive internal credentials from GitLab due to improper filtering of internal response headers. The issue allows retrieval of server authentication data when an unauthenticated user sends specific requests. This vulnerability can lead to credential theft and potential lateral movement within the organization.

GitLab Community Edition and Enterprise Edition versions from 17.6.5 up to, but not including, 19.3.6; 19.4 prior to 19.4.3; and 19.5 prior to 19.5.1 are impacted.

The CVSS base score of 4.3 indicates a moderate severity assessment, and the EPSS score is not available, suggesting limited public exploitation data. The vulnerability is not listed in CISA KEV, meaning no known active attacks are being tracked. Exploitation requires unauthenticated access to a GitLab instance and sending a crafted HTTP request that causes the application to reflect internal headers in the response. Because the attack does not require administrative privileges, the potential for credential compromise is significant but the likelihood of widespread exploitation is currently low.