GitLab: Pages logs and error-tracking events record request secrets, exposing access tokens

Impact

GitLab Pages writes sensitive request data into its log files and error-tracking events, so anyone who can read that log data can recover access tokens and other secrets that passed through requests. On a self-managed GitLab that drives cluster CI/CD, those tokens are credentials against the repositories, registries and deploy pipelines that build and ship workloads onto the GPU fleet, and log data is commonly shipped to an observability stack where the audience is far wider than the GitLab admin group. The advisory requires high privileges to reach the log data and rates it confidentiality-only, but any token found there must be treated as compromised because log retention outlives the request.

Who can reach it

An authenticated user with access to GitLab Pages log data - directly on the instance or through whatever log aggregation and error-tracking service those events are forwarded to.

What to do

Upgrade self-managed GitLab to 19.4.2, 19.3.5 or 19.2.8 and restart the instance. Then rotate tokens that may have been logged and purge or restrict the retained Pages logs and error-tracking events in the downstream observability stack - the cleanup, not the patch, is the expensive part here. Application-tier work only; no GPU node maintenance.

References

Related entries

• OpenTelemetry eBPF Profiler: unprivileged process can stall the agent by mapping a FIFOCVE-2026-48496 · OpenTelemetry eBPF Profiler (ELF mapping file handling)Medium
• AMD TEE / ASP bootloader syscall input validation: Insufficient validation of syscall inputs in the AMD trustedCVE-2021-46759 · AMD TEE / ASP bootloader syscall input validationMedium
• HashiCorp Consul: Missing Content-Type header lets user input be reinterpretedCVE-2024-10086 · HashiCorp ConsulMedium
• SPI flash configuration (flash descriptor / protected range registers) across multiple Intel platformsCVE-2017-5703 · SPI flash configuration (flash descriptor / protected range registers) across multiple Intel platformsMedium
• Intel Data Center GPU Max Series 1100 / 1550: An improper conditions check lets a privileged local user takeCVE-2023-47165 · Intel Data Center GPU Max Series 1100 / 1550Medium
• AMD PCIe link handling (memory buffer bounds): A guest VM can drive the PCIe link into an out-of-bounds conditionCVE-2024-21961 · AMD PCIe link handling (memory buffer bounds)Medium