CVE-2026-105777
Medium · 4.3CVSS
4.3
EPSS
0.3%
Published
Oct 22, 2026
CISA due date
—
The record
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6.5 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, an unauthenticated user could have retrieved sensitive internal server credentials due to improper filtering of internal response headers.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-107315 pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 through 42.7.13 pads a value that is… CWE-201
- CVE-2026-62088 Insertion of Sensitive Information Into Sent Data vulnerability in 10up ElasticPress… CWE-201
- CVE-2026-81804 Unauthenticated Sensitive Data Exposure in ZHBackup – Backup, Restore Migration <= 2.4.2… CWE-201
- CVE-2026-78303 Joomla Extension - joomshaper.com - Unvalidated Email Destination & Form Manipulation in… CWE-201
- CVE-2026-78374 Joomla Extension - joomlart.com - Open mail relay via contact AJAX endpoint in T4 Page… CWE-201
- CVE-2026-86505 In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust check leaked project… CWE-201
- CVE-2026-86497 In JetBrains YouTrack before 2026.2.18769 changing a mailbox host without… CWE-201
- CVE-2026-82209 When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary… CWE-201