GitLab Enterprise Edition has a vulnerability that allows sensitive data to be disclosed to an unintended host under certain conditions involving the handling of upstream requests in virtual registries. The flaw is rooted in improper credential protection, as identified by CWE‑522. If triggered, the exposure could reveal credentials or other confidential information to a malicious external system, thereby compromising confidentiality of the affected GitLab instance.

The affected product is GitLab EE from version 18.8 up through the releases immediately preceding 19.0.5, 19.1.3 and 19.2.1. The recommended action is to upgrade to any of the patched releases – 19.0.5, 19.1.3, 19.2.1 or later – to eliminate the vulnerability.

This bug carries a CVSS score of 5.4, indicating a moderate level of impact. The EPSS score is below 1 %, suggesting a very low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that exploitation would require an attacker to influence the upstream registry request flow, potentially by controlling an upstream service or manipulating registry configuration, so the attack vector is limited to scenarios where the GitLab instance processes external registry requests.