CVE-2026-105777: GitLab (Medium, CVSS 4.3)
CVE-2026-105777MediumGitLab
- CVSS
- 4.3 Medium (v3.1)
- EPSS
- 0.3% chance of exploitation in the next 30 days (higher than 15.4% of CVEs)
- Exploited in the wild
- Not on CISA’s KEV list
- Public exploit
- None reported in public exploit databases
- Weakness
- CWE-201
- Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N- Published
- Oct 22, 2026
What it is
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6.5 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, an unauthenticated user could have retrieved sensitive internal server credentials due to improper filtering of internal response headers.
Description from the National Vulnerability Database.
What to do
Check whether you run GitLab, then apply the vendor’s fix or mitigation from the advisories below.
ThreatRoundup coverage
CriticalCVE-2026-110264CVE-2026-15723+2 CVEs
GitLab’s CVSS 10 Regex Bug Reaches Back 12 Years to Version 7.0
Sources: NVD, FIRST EPSS, CISA KEV, and public exploit databases (availability only). ThreatRoundup reports whether public exploit code exists but never links to it: fake proof-of-concepts that infect security researchers are common. This page updates automatically.