CVE-2026-12053

This bug is like a “printer” that accidentally includes private text in the job log. If the wrong kind of workflow output makes it into the logs, someone could read sensitive information that was already stored in the project. Even though the information existed in the project, the logs make it easier to access it in ways it shouldn’t be.

This matters if your business uses GitLab EE and you can trigger or access Duo Workflows in your environment. The finding indicates no authentication or user interaction is required, and the attack can be done over the network; however, reachability in the default configuration is not confirmed in the findings. Treat this as relevant if your GitLab is exposed to the network and Duo Workflows are enabled/configured so the vulnerable behavior can be reached.

This should be treated as urgent patching because it’s a high-severity information exposure issue and GitLab has already released a fix. There’s no confirmed KEV listing and no public exploit code noted, so this is not “already widespread,” but the safest move is to upgrade now to eliminate the risk.