GitLab CE/EE: unauthenticated poisoning of the cached OIDC discovery document redirects auth flows

Impact

GitLab constructed endpoint URLs in cached OAuth/OIDC discovery responses while improperly trusting user-supplied values, so under some conditions an unauthenticated requester could poison the shared cache and point certain authentication flows at a server they control. Because the poisoned entry lives in a shared cache, the effect is not limited to the attacker's own session - the CVSS vector records a scope change. For a GPU operator this is a CI/CD and identity problem rather than a node problem: GitLab typically holds the pipelines that build and ship training and serving images and the runner credentials that reach the fleet, so redirected auth flows are a route to the supply chain for the cluster.

Who can reach it

Unauthenticated requests to a reachable GitLab instance, with user interaction required to complete the redirected flow per the vendor's vector (AV:N/AC:H/PR:N/UI:R). Any GitLab exposed to users or to the internet is in range.

What to do

Upgrade to GitLab 19.3.6, 19.4.3 or 19.5.1 (affected: all versions from 18.3 before those). For a self-managed instance that is a package upgrade and a service restart - the usual GitLab maintenance window, no node drain. Clear or let expire any poisoned discovery cache entries after upgrading. GitLab.com is already patched by the vendor.

References

Related entries

• IBM Storage Scale GUI (hardcoded inter-node token): A hardcoded token in the Storage Scale GUI source, usedCVE-2026-13460 · IBM Storage Scale GUI (hardcoded inter-node token)High
• Performance Co-Pilot: signed integer overflow in __pmGetPDU permanently blinds the collector daemonCVE-2026-16529 · Performance Co-Pilot pmcd/PMAPI (__pmGetPDU PDU length handling)High
• Apache Airflow: session cookie is set at path=/ regardless of base_url, enabling cross-app takeoverCVE-2026-28779 · Apache Airflow (session cookie `_token` path scope)High
• Apache Airflow: SQL error stack traces returned by the API despite expose_stack_traces=falseCVE-2026-30912 · Apache Airflow API (SQL error handling)High
• Apache Airflow: task JWT tokens written to logs let UI users act as Dag authorsCVE-2026-31987 · Apache Airflow (task JWT tokens in logs)High
• Apache Airflow: asset materialize permission lets a user trigger DAGs they have no access toCVE-2026-32228 · Apache Airflow (asset materialize permission)High