CVE-2026-11379: GitLab EE DAST Site Profile Authorization Flaw

Technical summary

A broken access control vulnerability exists in GitLab EE's DAST site profile management functionality. The flaw stems from insufficient authorization checks when handling site profile secrets, allowing users assigned the Developer role to exfiltrate sensitive credential material in certain conditions. The vulnerability is classified under CWE-863 (Incorrect Authorization) and has a CVSS 3.1 score of 5.3 (Medium severity) with a vector of CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating network accessibility, high attack complexity, low privilege requirement, no user interaction needed, and high confidentiality impact with no integrity or availability impact.

Business impact

Exposure of DAST site profile secrets could allow threat actors or malicious insiders to obtain credentials used for security testing environments, potentially leading to unauthorized access to staging systems, compromise of testing infrastructure, or lateral movement. This is particularly concerning for organizations that reuse testing credentials across environments or store production-adjacent secrets in DAST profiles. The impact is primarily confidentiality-driven, with no direct service availability or integrity consequences, though credential compromise can enable further attacks.

Affected systems

GitLab Enterprise Edition versions 13.11 through 18.11.5 (before 18.11.6), 19.0.0 through 19.0.2 (before 19.0.3), and 19.1.0 (before 19.1.1) are vulnerable. Community Edition and self-managed instances using Enterprise Edition features in the affected version ranges require remediation. Organizations running GitLab EE on or after the patched versions (18.11.6, 19.0.3, or 19.1.1) are not affected.

Exploitability

Exploitation requires a valid GitLab account with Developer role or higher on a project containing DAST site profiles, and the attack vector is network-based with no user interaction required. However, the CVSS score reflects 'High' attack complexity, suggesting specific conditions must be met—such as particular profile configurations or state dependencies—that make widespread automated exploitation less straightforward. This is not a trivial unauthenticated remote code execution risk, but rather a privilege escalation within GitLab that could be chained with other vulnerabilities or misconfigurations.

Remediation

Organizations must upgrade GitLab EE to version 18.11.6 or later, 19.0.3 or later, or 19.1.1 or later, depending on their current release track. Prior to patching, restrict Developer role assignments to trusted personnel, audit DAST site profile access logs, and consider rotating any secrets stored in DAST profiles if Developer accounts may have been compromised. For managed GitLab instances, verify patch application with your provider.

Patch guidance

GitLab has released security patches addressing this authorization flaw. Consult the official GitLab security advisory and release notes for version 18.11.6, 19.0.3, and 19.1.1 to confirm the patch is included. Test upgrades in non-production environments first, as GitLab updates may include breaking changes or require data migration. Automated update mechanisms should be validated before deployment to production. Verify the patch version against the vendor advisory to ensure the specific CVE-2026-11379 fix is included.

Detection guidance

Monitor GitLab audit logs for unusual access to DAST site profiles by users with Developer roles, particularly actions that download, export, or view profile secrets. Look for patterns such as multiple failed access attempts followed by successful secret retrieval, or access from unexpected IP addresses or times. Implement alerts on DAST profile API calls and secret retrieval events. If your GitLab instance logs API token usage, track calls to profile management endpoints. Consider periodically reviewing role assignments and access control lists for DAST profiles to catch misconfiguration.

Why prioritize this

While the CVSS score is Medium (5.3) and exploitation requires authentication, the confidentiality impact is high and the attack complexity is achievable with proper credentials. Organizations using DAST for security testing of production-critical applications, those with shared or reused credentials between environments, and those where Developer accounts may be operated by contractors or third parties should prioritize patching. The vulnerability is not in the CISA KEV catalog, reducing immediate pressure, but proactive patching within 2-4 weeks is recommended to close a clear privilege escalation vector.

Risk score, explained

The CVSS 5.3 Medium rating reflects a network-accessible vulnerability requiring low-privilege credentials and high attack complexity, with high confidentiality impact but no integrity or availability impact. The real-world risk depends on organizational factors: presence of sensitive credentials in DAST profiles, breadth of Developer role assignment, and the sensitivity of systems being tested. In organizations with strict credential management and limited Developer access, the practical risk is lower; in environments with shared credentials or loose access controls, the risk approaches High.

Frequently asked questions