CVE-2026-16553
GitLab has remediated an issue in GitLab EE affecting all versions from 18.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed some sensitive information to be disclosed to an unintended host due…
Does this matter?
Lower severity and a low EPSS score (0.25%). Track it; it rarely justifies an emergency change on its own.
Description
GitLab has remediated an issue in GitLab EE affecting all versions from 18.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed some sensitive information to be disclosed to an unintended host due to improper handling of upstream requests in virtual registries.
- CVSS 3.1
- 5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
- EPSS
- 0.25% probability · 17th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-522
- Affected
- gitlab/gitlab
- Source
- cve@gitlab.com
References
- https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-1-released/Release Notes, Vendor Advisory
- https://gitlab.com/gitlab-org/gitlab/-/work_items/603269Broken Link
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.