{"attribution":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","cve":{"id":"CVE-2026-105777","sourceIdentifier":"cve@gitlab.com","published":"2026-10-22T01:16:57.467","lastModified":"2026-11-04T23:10:00.223","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6.5 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, an unauthenticated user could have retrieved sensitive internal server credentials due to improper filtering of internal response headers."},{"lang":"es","value":"GitLab ha solucionado un problema en GitLab CE/EE que afecta a todas las versiones desde la 17.6.5 y anteriores a la 19.3.6, la 19.4 y anteriores a la 19.4.3, y la 19.5 y anteriores a la 19.5.1 que, bajo ciertas condiciones, un usuario no autenticado podría haber recuperado credenciales sensibles del servidor interno debido a un filtrado inadecuado de los encabezados de respuesta internos."}],"affected":[{"source":"cve@gitlab.com","affectedData":[{"vendor":"GitLab","product":"GitLab","defaultStatus":"unaffected","cpes":["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"],"repo":"https://gitlab.com/gitlab-org/gitlab","versions":[{"version":"17.6.5","lessThan":"19.3.6","versionType":"semver","status":"affected"},{"version":"19.4","lessThan":"19.4.3","versionType":"semver","status":"affected"},{"version":"19.5","lessThan":"19.5.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@gitlab.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T16:38:46.596029Z","id":"CVE-2026-105777","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@gitlab.com","type":"Secondary","description":[{"lang":"en","value":"CWE-201"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*","versionStartIncluding":"17.6.5","versionEndExcluding":"19.3.6","matchCriteriaId":"B18BB282-B7B2-4F4E-AF75-3D2DBFC4AD61"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"17.6.5","versionEndExcluding":"19.3.6","matchCriteriaId":"FDBE80B7-B332-4C1C-90EA-A18E1CE8C3F6"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*","versionStartIncluding":"19.4.0","versionEndExcluding":"19.4.3","matchCriteriaId":"12A85E28-FB9B-477D-BE6F-DE307EFEB4E0"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"19.4.0","versionEndExcluding":"19.4.3","matchCriteriaId":"30C796E1-40AA-41AF-8186-A49F78DC528D"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:19.5.0:*:*:*:community:*:*:*","matchCriteriaId":"2032C266-304B-4C69-95CA-56904EA5A64F"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:19.5.0:*:*:*:enterprise:*:*:*","matchCriteriaId":"7D6BE6DD-CA49-4E20-9541-22477632BA5D"}]}]}],"references":[{"url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/","source":"cve@gitlab.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://gitlab.com/gitlab-org/gitlab/-/work_items/597022","source":"cve@gitlab.com","tags":["Permissions Required"]},{"url":"https://hackerone.com/reports/3657282","source":"cve@gitlab.com","tags":["Permissions Required"]}]}}