Arbitrary Data Exposure in Git Fast Import and Export Features by GitLab
CVE-2026-114466

4.4MEDIUM

Key Information:

Vendor

Git

Status
Git
Vendor
CVE Published:
12 November 2026

What is CVE-2026-114466?

This vulnerability allows unauthorized users to read or write arbitrary data via the git-fast-import(1) and git-fast-export(1) functionalities in GitLab. These features, which are not sufficiently restricted, may lead to significant data exposure risks. Proper validation and access controls are essential to prevent potential exploitation.

Affected Version(s)

Git 2.50.1

Git 2.51.2

Git 2.52.0

References

https://gitlab.com/gitlab-org/git/-/work_items/812

CVSS V3.1

Score:
4.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

ehdgks0627, un3xploitable
.