GitLab’s Kubernetes proxy performed improper validation of URL redirects, allowing an authenticated user who controls a Kubernetes agent to direct the proxy to a malicious server. When the redirect is triggered, the proxy forwards sensitive authentication tokens to the unintended external site, exposing credentials and enabling unauthorized access. The flaw is an open‑redirect weakness (CWE‑601) that can lead to credential theft.

All GitLab Community and Enterprise Edition releases that do not contain the patch are affected. The range includes versions from 13.11 up to, but not including, 19.2.8, all 19.3 releases before 19.3.5, and all 19.4 releases before 19.4.2. The issue targets the Kubernetes proxy component within GitLab regardless of deployment topology.

The CVSS v3 score of 5.8 indicates moderate severity. Exploitation requires the attacker to be an authenticated user with the ability to manage Kubernetes agents, making external remote exploitation less likely. EPSS data is unavailable and the vulnerability is not listed in CISA’s KEV catalog. Nevertheless, credential leakage could compromise authentication mechanisms, so the risk to systems that expose GitLab to unauthenticated users or allow broad Kubernetes agent control remains significant.