CVE-2026-7767 in GitLab
Summary
by MITRE • 10/13/2026
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user controlling a Kubernetes agent to cause sensitive authentication tokens to be sent to an unintended server due to improper redirect validation in the Kubernetes proxy.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/13/2026
The vulnerability identified as CVE-2025-31987 represents a critical security flaw within GitLab Community Edition and Enterprise Edition, impacting versions ranging from 13.11 up to but not including 19.2.8, as well as the specific release windows of 19.3 prior to version 19.3.5 and 19.4 prior to version 19.4.2. This issue stems from a fundamental failure in input validation logic within the Kubernetes proxy component that GitLab utilizes for managing containerized workloads. The core technical deficiency lies in improper redirect validation, which allows an attacker who has achieved authenticated access with control over a Kubernetes agent to manipulate HTTP redirection responses. By exploiting this flaw, it is possible to force the application to send sensitive authentication tokens to servers controlled by the adversary rather than legitimate GitLab endpoints or internal services.
From a technical perspective, the vulnerability exploits how the proxy handles redirect headers when interacting with upstream Kubernetes API servers or associated service meshes. When an authenticated user possesses administrative privileges over a specific Kubernetes agent within their project or group namespace, they can trigger operations that result in HTTP redirects. The application fails to strictly validate the destination URL of these redirects against a whitelist of allowed domains or internal IP ranges. Consequently, if the attacker configures a malicious endpoint under their control as part of the Kubernetes resource configuration, the proxy will follow this redirect and transmit session cookies, OAuth tokens, or other sensitive authentication credentials associated with the user's active GitLab session to the external server. This mechanism effectively bypasses standard security controls that rely on domain validation for token transmission.
The operational impact of this vulnerability is severe due to its potential for credential theft and subsequent account compromise. An authenticated attacker can leverage this flaw to exfiltrate sensitive authentication tokens, which may include personal access tokens, OAuth bearer tokens, or session cookies. These credentials provide the attacker with elevated privileges within the GitLab instance, potentially allowing them to access private repositories, modify project settings, deploy malicious code, or escalate their privileges further by accessing other resources linked to the compromised account. In environments where single sign-on is integrated or where service accounts are used for automation pipelines, this vulnerability could lead to broader infrastructure compromise beyond just the GitLab application itself. The ability to send tokens to an unintended server effectively breaks the confidentiality and integrity guarantees expected in secure web applications.
This flaw aligns with CWE-601, which describes URL Redirection to Untrusted Site (Open Redirect), specifically manifesting through improper validation of redirect targets that leads to sensitive data exposure. Furthermore, from a tactical standpoint, this vulnerability maps directly to MITRE ATT&CK technique T1539, Steal Web Session Cookie, as well as aspects of T1078, Valid Accounts, since it requires initial authentication but leverages those credentials for unauthorized data exfiltration. The attack vector is classified as network-based with low complexity regarding exploitation once the prerequisite condition of having a controlled Kubernetes agent is met. It highlights the risks associated with complex integrations where proxy components handle dynamic redirections without rigorous allow-listing mechanisms.
Mitigation strategies must prioritize immediate patching to the latest stable versions mentioned in the advisory, specifically 19.2.8 or later for the 19.2 branch, 19.3.5 or later for the 19.3 branch, and 19.4.2 or later for the 19.4 branch. Organizations should verify their GitLab instance version via the administrative dashboard and apply updates during scheduled maintenance windows to minimize disruption. In addition to patching, administrators should review Kubernetes agent permissions within their projects to ensure that only trusted users have control over agent configurations. Implementing strict Content Security Policy headers and monitoring for unusual outbound traffic patterns from proxy components can provide additional layers of defense. Regular audits of redirect logic in custom integrations or plugins are also recommended to prevent similar vulnerabilities arising from non-standard code paths.