sunil kumawat@Sunil_kumawat17
Same release also fixes Duo AI job-troubleshooting leaking CI variables (CVE-2026-92470, EE). Fork: if non-admins can push CI on a shared instance, this is tonight — not a Monday ticket.
0000028
23 followersView on X
CVE-2026-92470
LOWCVSS 7.7 · HIGHSignal is active with 1 mentions in latest observed window
Immediate actions
- Track advisory updates for patch or workaround availability
Recommended action window: Monitor and triage in normal cycle
NVD description
GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to access sensitive CI/CD variable values from debug-mode job traces through the Duo AI troubleshooting feature due to missing authorization checks.
0.0/ 10 priority
Sources & remediation
Other references
Weakness type (CWE)
CWE-862
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
Threat summary
- 1 mentions across 1 observed day
What's happening
- 1 total mentions across 1 day