CVE-2026-105711

Use of Cache Containing Sensitive Information in GitLab

GitLab GitLabApplications & CMS

CVSS

3.5Low

ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV

Exploit odds (EPSS)0.21%Chance of exploitation activity in the next 30 days, higher than 10% of CVEs. Scored 23 Oct 2026FIRST EPSS

Fixed in19.3.6Also 19.4.3, 19.5.1CVE List

Published21 Oct 2026Updated 21 Oct 2026CVE List

What fixes it

19.3.6GitLabCVE List
19.4.3GitLabCVE List
19.5.1GitLabCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

GitLab Critical Patch Release: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13GitLab releases, 21 Oct 2026

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.0 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when a merge request in a public project referenced a confidential issue from a private project, an authenticated user with no project membership could have read the confidential issue's title, due to a viewer-independent fragment cache key that incorrectly shared per-user-redacted rendered content across all users.

Text from CVE List

Affected versions 3

GitLabaffected: 15.0 before 19.3.6CVE List
GitLabaffected: 19.4 before 19.4.3CVE List
GitLabaffected: 19.5 before 19.5.1CVE List