Unrated

Information Disclosure in GitLab EE Duo Workflows

IdentifiersCVE-2026-12053CWE-200

CVE-2026-12053 is a high-severity information disclosure vulnerability in GitLab Enterprise Edition (EE) Duo Workflows. According to the provided content, the issue affects GitLab EE version 19.1 before 19.1.1 and is caused by insufficient output filtering in Duo Workflows. Under certain conditions, this flaw could allow a user to access sensitive information that had already been committed to a project. The available information does not identify a specific vulnerable function or code path beyond Duo Workflows output handling/filtering.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation could disclose sensitive information already committed to a GitLab project to an unauthorized or unintended user. Based on the provided content, the primary impact is confidentiality loss within affected GitLab EE projects. No specific integrity or availability impact is established by the provided information.

Mitigation

If you can’t patch tonight, do this now.

If immediate upgrade is not possible, limit exposure to Duo Workflows usage in affected GitLab EE 19.1 deployments, restrict access to projects containing sensitive committed data to the minimum necessary users, and review Duo Workflows output handling for potential sensitive-data exposure. These are interim risk-reduction measures only; the definitive mitigation is vendor patching.

Remediation

Patch, then assume compromise.

Upgrade GitLab EE to version 19.1.1 or later. The provided content states that GitLab remediated the issue in 19.1.1 and urged self-managed customers to apply vendor patches and updates promptly. Where applicable, use the patched release streams referenced in the content for broader GitLab security updates.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

ACTIVITY FEED

Recent activity

6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

6 SOURCESView more in app

security weekNews

Jun 25, 2026

GitLab Patches Code Execution, Information Disclosure Vulnerabilities - SecurityWeek

A high-severity insufficient output filtering vulnerability in GitLab Duo Workflows that could allow users to access sensitive information already committed to a project.

cvefeed high severityNews

Jun 25, 2026

CVE-2026-12053 - Insertion of Sensitive Information into Log File in GitLab

An information disclosure vulnerability in GitLab EE caused by insufficient output filtering in Duo Workflows, potentially allowing access to sensitive information already committed to a project.

docs gitlabNews

Nov 1, 2018

GitLab Patch Release: 19.1.1, 19.0.3, 18.11.6 | GitLab Docs

A high-severity information disclosure vulnerability in GitLab EE Duo Workflows that could expose sensitive information already committed to a project.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity2

Community discussion across Reddit, Mastodon, and other social sources.

EXTERNAL REFERENCES

MITRE CVE

cve.org · CVE-2026-12053

NVD

nvd.nist.gov/vuln/detail/CVE-2026-12053

MITRE CWE · CWE-200

cwe.mitre.org