GitLab's CE/EE versions, including 9.3 through 18.11.5, 19.0.0 through 19.0.2, and 19.1.0, contain a flaw in a CI/CD API endpoint that fails to properly filter sensitive data. This flaw, classified as CWE‑532, allows data containing confidential information—such as passwords or tokens—to be written to application log files. If an attacker supplies input to the endpoint, the system records that input verbatim, potentially exposing secrets to anyone who has read access to the logs.

The vulnerable functionality is part of GitLab CE/EE distributed as GitLab:GitLab on all supported platforms. All releases from 9.3 up to 18.11.5, 19.0.0 through 19.0.2, and 19.1.0 through 19.1.0 are affected. The issue was remediated in GitLab 18.11.6, 19.0.3, and 19.1.1, and later releases inherit the fix.

The CVSS score of 4.4 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, so no widespread exploitation is known. However, because the flaw writes sensitive data to logs that may be accessible to users or administrators, the potential impact ranges from accidental disclosure of credentials to facilitating additional attacks. Based on the description, it is inferred that an attacker must have access to the vulnerable CI/CD API endpoint—typically an authenticated user with CI/CD privileges—to trigger the logging of secrets.