CVE-2026-12053: GitLab EE 19.1.0 Duo Workflows Information Disclosure – CVSS 8.6 HIGH

Technical summary

CVE-2026-12053 is an information disclosure vulnerability affecting GitLab EE 19.1.0, rooted in CWE-532 (Insertion of Sensitive Information into Log Files). The Duo Workflows feature fails to properly sanitize output before displaying results to users, allowing unauthenticated access to sensitive data that has been committed to a project repository. The network-accessible nature of GitLab combined with the lack of authentication requirement (PR:N in the CVSS vector) creates a direct exposure path. The vulnerability has a CVSS 3.1 base score of 8.6 (HIGH severity) reflecting the confidentiality impact across organizational boundaries (Scope:Changed).

Business impact

Exposure of committed project data—including credentials, API keys, private configuration, or proprietary code—directly through GitLab's web interface poses significant compliance and operational risk. Organizations using Duo Workflows in 19.1.0 must assume any committed secrets are compromised and should execute credential rotation immediately. For teams handling regulated data (PII, HIPAA, PCI-DSS), this vulnerability likely triggers breach notification obligations. The authentication-bypass nature (unauthenticated access) means every GitLab instance running 19.1.0 with Duo Workflows enabled is exploitable without internal network access or valid credentials.

Affected systems

GitLab Enterprise Edition version 19.1.0 is confirmed affected. GitLab Community Edition and Self-Managed versions prior to 19.1.1 should be verified against official vendor advisories, as the CVE description specifies EE. Any deployment running 19.1.0 with Duo Workflows active or enabled by default is in scope. SaaS instances managed by GitLab and self-hosted EE deployments are equally vulnerable if unpatched.

Exploitability

Exploitability is straightforward and requires no authentication, technical barriers, or user interaction. An attacker can trigger the vulnerability over the network using standard HTTP requests to a GitLab instance running 19.1.0. No special tooling or knowledge of internal systems is needed. The lack of a KEV (Known Exploited Vulnerability) designation does not imply low real-world risk; it reflects current public exploit tracking status, not vulnerability severity or actual exploitation in the wild. Organizations should treat this as actively exploitable given the trivial access requirements.

Remediation

Upgrade GitLab EE to version 19.1.1 or later as soon as possible. For organizations unable to patch immediately, disable or restrict access to Duo Workflows in 19.1.0 configurations. Conduct credential rotation for any secrets that may have been committed to affected repositories, including API keys, database credentials, and service account tokens. Audit workflow execution logs and output history to determine exposure scope. Verify patch application across all affected GitLab instances (both SaaS and self-managed).

Patch guidance

Apply GitLab EE 19.1.1 or the latest available patch for your deployment type. Verify the patch through GitLab's official release notes and security advisories before deploying to production. Test in a staging environment to confirm Duo Workflows functionality is restored and no regressions occur. Document patching dates and instances for compliance records. Monitor GitLab's security page for any additional CVEs affecting 19.1.x and related versions.

Detection guidance

Monitor GitLab instance version and Duo Workflows feature status across your environment. Check for access patterns or log entries showing workflow execution with output containing sensitive data (keywords: password, key, token, secret, credentials). Review audit logs for unauthenticated or anonymous access to Duo Workflows endpoints. If running 19.1.0, assume exposure occurred and prioritize credential rotation detection through your secrets management tooling. Endpoint Detection and Response (EDR) systems should flag lateral movement or credential usage originating from compromised secrets.

Why prioritize this

This vulnerability merits immediate remediation due to five converging factors: (1) HIGH CVSS score (8.6) driven by confidentiality impact and scope escalation; (2) zero authentication requirement, making every unpatched instance directly exploitable; (3) information disclosure of committed secrets, which typically cannot be 'unexposed' without credential rotation; (4) broad organizational impact if any team member uses GitLab 19.1.0; and (5) the stored nature of the data (already-committed sensitive information) means historical exposure persists until credentials are rotated. This is not a theoretical risk—it is active credential compromise.

Risk score, explained

The CVSS 3.1 score of 8.6 (HIGH) reflects: Network-accessible attack vector (AV:N), Low attack complexity with no special conditions (AC:L), No authentication required (PR:N), No user interaction needed (UI:N), Scope changed (multiple organizational units affected), High confidentiality impact (C:H), and no integrity or availability impact. The score appropriately captures the ease of exploitation and breadth of potential harm. Organizations should treat this as a critical security incident rather than a standard patch cycle, given the nature of data exposure and the universal accessibility of affected instances.

Frequently asked questions