CVE-2026-1724
Description
GitLab has remediated an issue in GitLab EE affecting all versions from 18.5 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an unauthenticated user to access API tokens of self-hosted AI models due to improper access control.
Summary dbcve.org
This is an improper access control vulnerability in GitLab EE that allowed unauthenticated users to access API tokens configured for self-hosted AI models. The issue stemmed from insufficient access controls on AI model configuration endpoints, enabling exposure of sensitive authentication credentials without authentication.
Mitigation
Upgrade GitLab EE to version 18.8.7, 18.9.3, 18.10.1 or later as specified in the official GitLab security advisory. Review and rotate any potentially exposed AI model API tokens as a precautionary measure.