Description
GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to access sensitive CI/CD variable values from debug-mode job traces through the Duo AI troubleshooting feature due to missing authorization checks.
Published: 2026-09-23
Score: 7.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Access to CI/CD Variables
Action: Patch
AI Analysis

Impact

An issue in GitLab Enterprise Edition allowed an authenticated user to retrieve sensitive CI/CD variable values from debug‑mode job traces by means of the Duo AI troubleshooting feature, because the software performed a missing authorization check.

Affected Systems

Affected installations include any GitLab EE server running version 18.7 or later but prior to 19.2.7, versions 19.3.0 through 19.3.2, or 19.4.0. The vendor patched the issue in releases 19.2.7, 19.3.3, 19.4.1 and all subsequent versions. GitLab:GitLab is the sole vendor listed for this vulnerability.

Risk and Exploitability

The vulnerability has a CVSS score of 7.7, reflecting high severity. No EPSS score is available in the current data, and the vulnerability is not listed in the CISA KEV catalog. The flaw requires an authenticated user and can be exercised via the Duo AI interface when debug‑mode job traces are enabled. Attackers can obtain confidential CI/CD variables that could be used for further compromise.

Generated by OpenCVE AI on September 24, 2026 at 01:23 UTC.

Remediation

Vendor Solution

Upgrade to versions 19.2.7, 19.3.3, 19.4.1 or above.

OpenCVE Recommended Actions

  • Upgrade to GitLab 19.2.7, 19.3.3, 19.4.1 or later to address the missing authorization checks.
  • If an upgrade cannot be performed immediately, disable the Duo AI troubleshooting feature or restrict its use to privileged roles to prevent unauthorized access to debug traces.
  • Review role‑based access controls to ensure that only authorized users can enable debug‑mode job traces, and remove any excessive permissions that would allow reading of CI/CD variables.

Generated by OpenCVE AI on September 24, 2026 at 01:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 28 Sep 2026 19:15:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
cpe:2.3:a:gitlab:gitlab:19.4.0:*:*:*:enterprise:*:*:*

Thu, 24 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 23 Sep 2026 23:30:00 +0000

Type Values Removed Values Added
Description GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to access sensitive CI/CD variable values from debug-mode job traces through the Duo AI troubleshooting feature due to missing authorization checks.
Title Missing Authorization in GitLab
First Time appeared Gitlab
Gitlab gitlab
Weaknesses CWE-862
CPEs cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*
Vendors & Products Gitlab
Gitlab gitlab
References
Metrics cvssV3_1

{'score': 7.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N'}

Subscriptions

Gitlab Gitlab
cve-icon MITRE

Status: PUBLISHED

Assigner: GitLab

Published:

Updated: 2026-09-24T14:38:46.234Z

Reserved: 2026-09-16T11:35:25.878Z

Link: CVE-2026-92470

cve-icon Vulnrichment

Updated: 2026-09-24T14:38:42.896Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-24T00:17:22.193

Modified: 2026-09-28T19:00:29.650

Link: CVE-2026-92470

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-24T02:15:14Z

Weaknesses