CVE-2026-4523: 
GitLab Schwachstellenanalyse und -minderung

CVE-2026-4523 is a missing authorization vulnerability in GitLab CE/EE that, under certain conditions, allows unauthenticated users to read CI/CD job trace contents containing sensitive variable values via the GraphQL API. It affects all versions from 15.11 through 19.2.6, 19.3.0 through 19.3.2, and 19.4.0. The vulnerability was published on September 29, 2026, and patched versions were released shortly after. It carries a CVSS v3.1 base score of 3.7 (Low) (GitHub Advisory, Feedly).

The root cause is classified as CWE-862 (Missing Authorization): the GitLab GraphQL API fails to properly enforce authorization checks when serving CI/CD job trace data under certain conditions, allowing unauthenticated network requests to retrieve job log contents. The attack vector is network-based, requires no privileges or user interaction, but has high attack complexity, suggesting that specific conditions (such as particular job visibility settings or race conditions) must be met for exploitation to succeed. No public technical write-up or proof-of-concept code has been identified at this time (GitHub Advisory, Feedly).

Successful exploitation results in unauthorized disclosure of CI/CD job trace contents, which may include sensitive variable values such as API keys, credentials, tokens, or other secrets injected into pipeline jobs. The impact is limited to confidentiality — there is no integrity or availability impact — but exposed secrets could enable lateral movement, privilege escalation, or supply chain compromise depending on the nature of the leaked variables (GitHub Advisory, Feedly).

There is no evidence of active in-the-wild exploitation or a publicly available proof-of-concept as of the time of publication. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.345%, placing it in the 26th percentile for exploitation likelihood within 30 days. The high attack complexity requirement further reduces the practical exploitability of this vulnerability (GitHub Advisory, Feedly).

GitLab has released patched versions addressing this vulnerability: 19.2.7, 19.3.3, and 19.4.1. Administrators should upgrade to the appropriate fixed version based on their current deployment. If immediate patching is not feasible, restrict network access to the GitLab GraphQL API endpoint and monitor for unauthorized access attempts to CI/CD job traces. Rotating any secrets or sensitive variables stored in CI/CD job logs is also recommended as a precautionary measure (GitLab Patch Release, GitHub Advisory).