Description
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under a race condition, the MCP search tool's shared state handling could have caused search results to be returned under an incorrect user context.
Affected products
gitlab: gitlab
References2
- docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-1-re… Release NotesVendor Advisory
- gitlab.com/gitlab-org/gitlab/-/work_items/621933 Issue Tracking
Metrics
- CVSS 3.1
-
3.1
LOW
Score source: CNA
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N - EPSS — exploit probability
- 0% percentile: 4 · as of 9 November 2026
- CWE
- CWE-362
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.