GitLab Enterprise Edition versions from 19.1 through 19.1.1 were discovered to log sensitive data when Duo Workflows executed due to inadequate output filtering. This flaw allowed a user who could trigger a Duo Workflow to read previously committed confidential information from log files, effectively leaking data that had already been committed to the repository. The weakness aligns with CWE‑532, insertion of sensitive data into logs, which compromises confidentiality.

All GitLab Enterprise Edition installations running versions 19.1, 19.1.0, and any sub‑minor release prior to 19.1.1 are affected. The vulnerability is specific to GitLab’s Duo Workflows component and does not impact GitLab CE or later versions of EE beyond 19.1.1.

The CVSS score of 8.6 classifies the issue as high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting exploitation is unlikely to be widespread at present. The likely attack vector requires a user with permission to initiate a Duo Workflow; an attacker with such access could read confidential data from log files and persistently expose it. The impact is limited to disclosure of information but effectively enables unauthorized data access within the affected system.