CVE-2026-112212: GitLab CE/EE cache poisoning in OAuth/OIDC discovery endpoints

GitLab acts as an OAuth 2.0 and OpenID Connect provider, and clients read its discovery document (the well-known openid-configuration) to learn where the authorization, token and userinfo endpoints are. GitLab says it built those endpoint URLs using values supplied in the request and trusted them. If a shared cache, such as a CDN or reverse proxy in front of GitLab, stores that response, every later client receives the poisoned document.

The result is that applications using GitLab for single sign-on may send users, or exchange codes and tokens, with a server the attacker controls. That can leak authorization codes, tokens or credentials. The vector reflects the preconditions: no account is needed, but the attack depends on a shared cache and on a user starting a sign-in flow. GitLab found this internally.

Self-managed GitLab CE/EE from 18.3 before 19.3.6, 19.4 before 19.4.3 and 19.5 before 19.5.1. Exposure is highest where a shared cache or CDN sits in front of GitLab and caches the discovery endpoints, and where other applications use GitLab as an OAuth or OIDC provider. Inspect the document clients receive:

curl -s https://gitlab.example.com/.well-known/openid-configuration | jq '.issuer, .authorization_endpoint, .token_endpoint'

Every URL should point at your own GitLab host.

Upgrade to 19.5.1, 19.4.3 or 19.3.6. After upgrading, purge the cached discovery documents (/.well-known/openid-configuration and /.well-known/oauth-authorization-server) from any CDN or reverse proxy so a poisoned copy is not served from cache. Configuring the cache not to store these endpoints, or to key them on the full host, reduces the risk until you upgrade.

Check cached discovery responses for endpoint URLs that do not match your GitLab hostname, and proxy logs for discovery requests carrying unusual Host or forwarded headers. On the client side, look for OAuth flows that redirected users to unfamiliar domains and failed token exchanges. If a poisoned document was served, revoke and reissue OAuth application secrets and tokens issued during that window.

Under certain conditions, an unauthenticated user could have poisoned a shared cache's OAuth/OIDC discovery document to redirect certain flows to an externally controlled server, due to improper trust of user-supplied values when constructing endpoint URLs in cached discovery responses. Impacted versions: GitLab CE/EE all versions from 18.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1. Fixed in GitLab CE/EE 19.5.1, 19.4.3 and 19.3.6, released October 21, 2026.