CVE-2026-112212 GitLab CVE debrief

Who should care

Defenders responsible for GitLab CE/EE instances, particularly those with unauthenticated access or exposed to external users, should assess exposure and apply remediation. They should also verify instance version, check for potential backdoors, and monitor for suspicious activity related to OAuth/OIDC flows. Security teams should review system logs for signs of unauthorized access or suspicious activity and implement additional security measures, such as

Why it matters

CVE-2026-112212 allows unauthenticated users to manipulate OAuth/OIDC discovery documents, potentially leading to unauthorized access or redirection. Defenders should verify exposure, apply remediation, and monitor for suspicious activity.

• Potential unauthorized access to OAuth/OIDC flows.
• Possible redirection to externally controlled servers.
• Need for verification of instance version and exposure.
• Priority on applying vendor remediation.

Technical summary

The vulnerability affects GitLab CE/EE versions from 18.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1. An unauthenticated user could poison a shared cache's OAuth/OIDC discovery document to redirect certain flows to an externally controlled server due to improper trust of user-supplied values. This could lead to unauthorized access or redirection. Defenders should prioritize verifying exposure and applying remediation for GitLab CE/EE instances, particularly those with unauthenticated access or exposed to external users.

Defensive priority

Defenders should prioritize verifying exposure and applying remediation for GitLab CE/EE instances, particularly those with unauthenticated access or exposed to external users.

Recommended defensive actions

• Verify GitLab CE/EE instance version and check if it falls within affected ranges.
• Apply remediation by updating to version 19.3.6, 19.4.3, or 19.5.1.
• Review and restrict access to shared cache's OAuth/OIDC discovery document.
• Monitor for suspicious activity related to OAuth/OIDC flows.
• Perform vulnerability scanning to identify potentially exposed instances.
• Review system logs for signs of unauthorized access or suspicious activity.
• Implement additional security measures, such as multi-factor authentication, for sensitive systems.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, affected versions, and vendor remediation. However, there is limited information on actual exploitation or victim impact. Defenders should verify instance version, check exposure, and apply remediation. The vulnerability affects GitLab CE/EE versions from 18.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1. There is no evidence of exploitation in the wild, but defenders should monitor for suspicious activity related to OAuth/OIDC flows.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.