Loading vulnerability…
Information Disclosure in GitLab EE Duo Workflows
CVE-2026-12053 is a high-severity information disclosure vulnerability in GitLab Enterprise Edition affecting all 19.1 releases before 19.1.1. The flaw is attributed to insufficient output filtering in Duo Workflows. Under certain conditions, the vulnerable workflow output could expose sensitive information that had already been committed to a project, allowing a user to retrieve data that should not have been disclosed through that feature. The issue is remotely exploitable and impacts confidentiality rather than direct code execution or service availability.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows disclosure of sensitive information contained in project commits. An attacker or user able to trigger the vulnerable Duo Workflows behavior could obtain confidential project data that was already present in the repository, potentially exposing secrets or other sensitive committed content to unauthorized parties.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce or disable exposure to Duo Workflows where operationally feasible, restrict access to affected GitLab EE instances and projects to the minimum necessary users, and review workflow output handling for unintended disclosure of sensitive committed content. Because the issue is caused by insufficient output filtering, limiting use of the affected feature and tightening access controls can reduce exposure until the fixed release is deployed.
Patch, then assume compromise.
Upgrade GitLab Enterprise Edition to version 19.1.1 or later. GitLab shipped fixes for this issue in 19.1.1, and self-managed deployments should apply the vendor update promptly as part of the June 2026 security release cycle.
No public exploits tracked yet. Mallory keeps watching.
9 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.
No news coverage yet. Advisories and community discussion only.