CVE-2026-11827: GitLab EE Credential Access Vulnerability – Affected Versions & Patches

Technical summary

CVE-2026-11827 is an improper authorization vulnerability (CWE-522) in GitLab EE stemming from insufficient access controls around stored credential retrieval. An authenticated user holding maintainer role can exploit a logic flaw to bypass authorization checks and access credentials stored for other users. The vulnerability requires high-privilege authenticated access (PR:H in CVSS terms) and does not require user interaction. Network-accessible GitLab instances are at risk if maintainer accounts are compromised or if organizational access controls are overly permissive.

Business impact

Credential theft through this vulnerability exposes integrations, API tokens, deployment keys, and other secrets that other team members rely on for CI/CD pipelines, external service connections, and infrastructure automation. A malicious or compromised maintainer could exfiltrate these credentials to pivot to downstream systems, access customer infrastructure, or establish persistence in dependent services. For organizations using GitLab as a central hub for secrets management, this compounds the blast radius significantly.

Affected systems

GitLab Enterprise Edition versions 9.5 through 18.11.6, all 19.0 releases before 19.0.4, and 19.1 releases before 19.1.2 are affected. Community Edition is not mentioned in the advisory, suggesting the vulnerability is specific to EE features or their implementation. Self-hosted and GitLab.com SaaS instances running unpatched versions are in scope if they match the named version ranges.

Exploitability

Exploitation requires pre-existing maintainer-level access, which significantly restricts the attacker pool compared to unauthenticated or lower-privileged attacks. However, maintainer roles are often granted to developers and CI/CD operators, expanding the internal threat surface. No user interaction is required once maintainer access is obtained, and the attack is reproducible across affected versions. The CVSS score of 4.9 (MEDIUM) reflects the high privilege requirement offset by the high confidentiality impact.

Remediation

Upgrade GitLab EE to version 18.11.7 or later for the 18.11 line, 19.0.4 or later for the 19.0 line, or 19.1.2 or later for the 19.1 line. Organizations on earlier versions in the 9.5–18.11.6 range should also prioritize upgrading to a current supported release. No workaround is documented; patching is the primary remediation path. Post-upgrade, audit maintainer role assignments and review credential access logs where available.

Patch guidance

Plan upgrades during a maintenance window; GitLab upgrades may require service downtime or use of zero-downtime deployment procedures depending on your infrastructure. Test patches in a non-production environment first. Verify the upgrade succeeds and that credential retrieval controls are functioning as expected. For GitLab.com SaaS users, patching is automatic; no action is required. After patching, consider rotating credentials that may have been exposed during the vulnerability window, particularly for high-value integration tokens and API keys.

Detection guidance

Examine GitLab access logs and audit trails for maintainers accessing credential endpoints or APIs that retrieve stored secrets for other users. Correlate successful authentication events with credential retrieval requests from the same source IP or account. If GitLab provides credential access audit logs, flag any retrievals by users who did not create the credential. Internal security scanning tools can check GitLab version via the API and flag instances on vulnerable release lines. Network-based detection is limited because the attack uses legitimate API calls; application-level logging is essential.

Why prioritize this

Although the CVSS score is MEDIUM and exploitability is constrained by privilege requirements, the confidentiality impact is HIGH—stolen credentials enable lateral movement and privilege escalation in downstream systems. Organizations with highly permissive maintainer role assignment, shared credentials, or sensitive integrations should treat this as higher priority. Combine this with your GitLab deployment posture: cloud-hosted instances accessible to many team members warrant faster patching than isolated self-hosted instances with restricted maintainer access.

Risk score, explained

The CVSS 3.1 score of 4.9 reflects a network-accessible vulnerability (AV:N) with low attack complexity (AC:L) but high privilege requirement (PR:H) and no user interaction (UI:N). Confidentiality is fully compromised (C:H), while integrity and availability are not affected (I:N, A:N). The score appropriately penalizes the privilege barrier while crediting the high sensitivity of the leaked data. Context matters: internal threat actors with maintainer access pose greater risk than external attackers, warranting organizational risk assessment above the base CVSS score.

Frequently asked questions