Loading vulnerability…
Credential disclosure in GitLab Workhorse internal data-emission endpoints
CVE-2026-82837 is an improper authorization vulnerability in GitLab Community Edition and Enterprise Edition internal Workhorse data-emission endpoints. Under certain conditions, an authenticated user can access sensitive credentials and tokens without passing through the expected proxy. Affected versions are 10.1.0 through versions before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation compromises the confidentiality of sensitive credentials and tokens. Depending on the permissions and scope of the exposed secrets, their subsequent misuse could enable unauthorized access to protected services or data. Direct code execution, privilege escalation, and availability impacts are not established for this vulnerability.
If you can’t patch tonight, do this now.
Until patching is complete, restrict GitLab access to trusted users and networks, minimize user permissions, and apply network controls around GitLab and its proxy infrastructure. Monitor internal data-emission endpoint access and credential use for anomalies. These measures reduce exposure but are not an established substitute for the security update.
Patch, then assume compromise.
Upgrade GitLab CE/EE to 19.1.8 or later in the 19.1 release branch, 19.2.6 or later in the 19.2 release branch, or 19.3.2 or a subsequent fixed release. Follow the supported upgrade path and deployment-specific procedures, including any required database migrations and downtime planning.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.