CVE-2026-100755
Received Received - Intake

Improper Cache Key Construction in GitLab CE/EE

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: GitLab Inc.

Description
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain deployment configurations, could have allowed an authenticated user to poison cached page content served to other users due to improper cache key construction.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-100755
EUVD
EUVD-2026-98211

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
GitLab GitLab 16.2
GitLab GitLab 19.3
GitLab GitLab 19.4

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-349 The product, when processing trusted data, accepts any untrusted data that is also included with the trusted data, treating the untrusted data as if it were trusted.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in GitLab CE/EE versions 16.2 to 19.4 allows an authenticated user to manipulate cached page content served to others due to incorrect cache key construction. This could result in users seeing malicious or incorrect content instead of the intended page.

Impact Analysis

An attacker could serve altered content to users, potentially leading to misinformation, phishing attempts, or data exposure. Users might unknowingly interact with malicious content, compromising their data or actions on the platform.

Compliance Impact

This vulnerability could lead to unauthorized data exposure or manipulation, violating GDPR's integrity and confidentiality principles or HIPAA's safeguards for protected health information. Compliance may be compromised if user data is altered or accessed improperly.

Mitigation Strategies

Upgrade GitLab to version 19.2.8, 19.3.5, or 19.4.2 or later to address the improper cache key construction issue. This remediates the vulnerability by fixing the root cause of cached page content poisoning.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100755. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart