GitLab Community Edition/Enterprise Edition up to 18.11.5/19.0.2/19.1.0 CD API Endpoint log file

Summaryinfo

A vulnerability, which was classified as problematic, was found in GitLab Community Edition and Enterprise Edition up to 18.11.5/19.0.2/19.1.0. The affected element is an unknown function of the component CD API Endpoint. Such manipulation leads to log file. This vulnerability is documented as CVE-2026-8330. The attack needs to be performed locally. There is not any exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in GitLab Community Edition and Enterprise Edition up to 18.11.5/19.0.2/19.1.0 and classified as problematic. Affected by this issue is some unknown functionality of the component CD API Endpoint. The manipulation with an unknown input leads to a log file vulnerability. Using CWE to declare the problem leads to CWE-532. Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information. Impacted is confidentiality. CVE summarizes:

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.3 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed sensitive information to be written to application logs due to insufficient filtering in a CI/CD API endpoint.

The advisory is shared for download at gitlab.com. This vulnerability is handled as CVE-2026-8330 since 05/11/2026. The exploitation is known to be easy. The attack needs to be approached locally. The exploitation needs additional levels of successful authentication. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1592.

The vulnerability scanner Nessus provides a plugin with the ID 322743 (GitLab 9.3 < 18.11.6 / 19.0 < 19.0.3 / 19.1 < 19.1.1 (CVE-2026-8330)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 18.11.6, 19.0.3 or 19.1.1 eliminates this vulnerability. The upgrade is hosted for download at docs.gitlab.com.

The vulnerability is also documented in the databases at Tenable (322743) and EUVD (EUVD-2026-39172). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Bug Tracking Software

Vendor

• GitLab

Name

• Community Edition
• Enterprise Edition

Version

• 18.11.0
• 18.11.1
• 18.11.2
• 18.11.3
• 18.11.4
• 18.11.5
• 19.0
• 19.0.0
• 19.0.1
• 19.0.2
• 19.1.0

License

• open-source

Website

• Vendor: https://gitlab.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion