Description
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under a race condition, the MCP search tool's shared state handling could have caused search results to be returned under an incorrect user context.
Published: 2026-09-23
Score: 3.1 Low
EPSS: < 1% Very Low
KEV: No
Impact: Information Disclosure
Action: Patch
AI Analysis

Impact

GitLab suffers a race condition in the MCP search tool’s handling of shared state due to improper synchronization. The flaw can cause search results to be returned under an incorrect user context, allowing an attacker to see another user’s data. The weakness is a classic Race Condition, classified as CWE-362, leading to potential information disclosure.

Affected Systems

GitLab Community Edition and Enterprise Edition versions from 18.6 up to but not including 19.2.7, from 19.3 up to but not including 19.3.3, and from 19.4 up to but not including 19.4.1 are affected. The fix is available in GitLab 19.2.7, 19.3.3, 19.4.1 and later.

Risk and Exploitability

The CVSS score of 3.1 indicates low severity, and the EPSS score is not available, with no listing in CISA’s KEV catalog. Exploitation requires concurrent accesses to the MCP search tool, which is more likely in high‑volume or multi‑user environments, but the overall risk remains low to moderate as the impact is limited to information leakage.

Generated by OpenCVE AI on September 24, 2026 at 00:52 UTC.

Remediation

Vendor Solution

Upgrade to versions 19.2.7, 19.3.3, 19.4.1 or above.

OpenCVE Recommended Actions

  • Upgrade to GitLab 19.2.7, 19.3.3, or 19.4.1 and later.
  • If an upgrade cannot be applied immediately, disable the MCP search tool or restrict it to a trusted user subset until the fix is in place.
  • Implement rate limiting or a concurrency guard on the MCP search API through your application firewall or load balancer to reduce the likelihood of a race condition occurring.

Generated by OpenCVE AI on September 24, 2026 at 00:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 28 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
cpe:2.3:a:gitlab:gitlab:19.4.0:*:*:*:community:*:*:*
cpe:2.3:a:gitlab:gitlab:19.4.0:*:*:*:enterprise:*:*:*

Thu, 24 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 23 Sep 2026 23:30:00 +0000

Type Values Removed Values Added
Description GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under a race condition, the MCP search tool's shared state handling could have caused search results to be returned under an incorrect user context.
Title Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in GitLab
First Time appeared Gitlab
Gitlab gitlab
Weaknesses CWE-362
CPEs cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*
Vendors & Products Gitlab
Gitlab gitlab
References
Metrics cvssV3_1

{'score': 3.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Gitlab Gitlab
cve-icon MITRE

Status: PUBLISHED

Assigner: GitLab

Published:

Updated: 2026-09-24T13:11:17.094Z

Reserved: 2026-09-16T15:35:11.125Z

Link: CVE-2026-92628

cve-icon Vulnrichment

Updated: 2026-09-24T13:10:35.431Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-24T00:17:22.583

Modified: 2026-09-28T15:22:49.920

Link: CVE-2026-92628

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-24T01:15:07Z

Weaknesses
  • CWE-362

    Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')