CVE-2026-92628
Received Received - Intake

Race Condition in GitLab CE/EE MCP Search Tool

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: GitLab Inc.

Description
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under a race condition, the MCP search tool's shared state handling could have caused search results to be returned under an incorrect user context.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-24
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-92628
EUVD
EUVD-2026-85731

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
gitlab gitlab_ce From 18.6 (inc) to 19.2.7 (exc)
gitlab gitlab_ee From 18.6 (inc) to 19.2.7 (exc)
gitlab gitlab_ce From 19.3.0 (inc) to 19.3.3 (exc)
gitlab gitlab_ee From 19.3.0 (inc) to 19.3.3 (exc)
gitlab gitlab_ce From 19.4.0 (inc) to 19.4.1 (exc)
gitlab gitlab_ee From 19.4.0 (inc) to 19.4.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-362 The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in GitLab CE/EE versions before 19.2.7, 19.3.3, and 19.4.1 involves a race condition in the MCP search tool's shared state handling. This could cause search results to be returned under an incorrect user context, potentially exposing sensitive data to unauthorized users.

Detection Guidance

This vulnerability involves a race condition in GitLab's MCP search tool that may expose incorrect user search results. To detect it, check GitLab server logs for unusual search activity or errors related to the MCP tool. Verify that all GitLab instances are updated to versions 19.2.7, 19.3.3, or 19.4.1 or later to ensure the fix is applied.

Impact Analysis

An attacker could exploit this flaw to access search results belonging to other users, leading to unauthorized information disclosure. This may include sensitive data like private repositories, issues, or other restricted content.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating confidentiality requirements in GDPR and HIPAA. Organizations using affected GitLab versions may face compliance violations, potential fines, and reputational damage due to data breaches.

Mitigation Strategies
  • Upgrade GitLab CE/EE to version 19.2.7, 19.3.3, or 19.4.1 or later to address the race condition in the MCP search tool.
  • Monitor for unusual search results or unauthorized access patterns in user contexts as a potential indicator of exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-92628. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart