CVE-2026-101168
Received Received - Intake

Authenticated User Access Token Exposure in GitLab Pages

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: GitLab Inc.

Description
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.0 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with access to GitLab Pages log data to obtain access tokens and other secrets, due to insertion of sensitive request data into log files and error tracking events.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-101168
EUVD
EUVD-2026-98210

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
GitLab GitLab 12.0
GitLab GitLab 19.3
GitLab GitLab 19.4

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-532 The product writes sensitive information to a log file.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in GitLab CE/EE versions 12.0 to 19.2.7, 19.3.0 to 19.3.4, and 19.4.0 to 19.4.1 allows an authenticated user with GitLab Pages log access to obtain access tokens and other secrets. The issue occurs because sensitive request data, including secrets, is inserted into log files and error tracking events.

Impact Analysis

If exploited, this vulnerability could lead to unauthorized access to sensitive data such as access tokens and secrets. Attackers might gain elevated privileges or extract confidential information, potentially affecting data integrity and confidentiality for affected GitLab instances.

Compliance Impact

This vulnerability could lead to unauthorized exposure of personal or sensitive data, violating GDPR and HIPAA compliance requirements. Organizations may face legal penalties, loss of trust, and increased scrutiny due to potential data breaches resulting from this issue.

Mitigation Strategies

Upgrade GitLab CE/EE to version 19.2.8, 19.3.5, or 19.4.2 or later to remediate the vulnerability. Review GitLab Pages log data for unauthorized access tokens or secrets and revoke any exposed credentials immediately.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-101168. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart