Cyber Resilience

CVE-2025-9958

Info Disclosure in Gitlab 14.10.0 – 18.2.7

Published
26 September 2025
Modified
06 November 2025
CVSS Score v3.1 7.7
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
EPSS Score 0.0046 38th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2025-9958 is a high-severity Insertion of Sensitive Information Into Sent Data (CWE-201) vulnerability in Gitlab Gitlab. Its CVSS base score is 7.7 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Configuration Repository (T1602); ranked at the 38th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

An issue has been discovered in GitLab CE/EE affecting all versions from 14.10 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1, that could have allowed Guest users to access sensitive information stored in virtual registry configurations.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1602 Data from Configuration Repository Collection
Adversaries may collect data related to managed devices from configuration repositories.
Why these techniques?

Information disclosure in registry configs directly enables access to configuration repository data.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2023-3413Same product: Gitlab Gitlab
CVE-2023-1401Same product: Gitlab Gitlab
CVE-2023-5831Same product: Gitlab Gitlab
CVE-2023-1825Same product: Gitlab Gitlab
CVE-2025-7000Same product: Gitlab Gitlab
CVE-2023-3102Same product: Gitlab Gitlab
CVE-2025-2615Same product: Gitlab Gitlab
CVE-2023-3399Same product: Gitlab Gitlab
CVE-2023-4002Same product: Gitlab Gitlab
CVE-2023-3949Same product: Gitlab Gitlab

Affected Assets

gitlab
gitlab
18.4.0 · 14.10.0 — 18.2.7 · 14.10.0 — 18.2.7 · 18.3.0 — 18.3.3

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • AC-3 Access Enforcement
  • AC-6 Least Privilege
  • AC-4 Information Flow Enforcement
Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)
  • 1 hardening rule · 1 OS baseline
Validate
Prove the fix (OWASP ASVS)
  • V14.2.3

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly enforces authorization policy so that Guest-role users cannot retrieve sensitive virtual registry configuration data.

prevent

Ensures the Guest role is granted only the minimum privileges required, eliminating access to registry configuration objects.

prevent

Enforces information-flow rules that block unauthorized disclosure of sensitive configuration attributes to low-privilege users.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly prevent insertion of sensitive data into application outputs and messages.

DE.CM-09 partial match
prevents

Monitoring runtime data flows and outputs can detect sensitive data being transmitted.

PR.DS-02 partial match
prevents

Protecting data-in-transit can include filtering or encrypting to avoid exposing sensitive content.

PR.DS-10 partial match
prevents

Protecting data-in-use includes removing confidential values before they are processed or sent.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

prevents

Data-masking techniques can prevent sensitive values from appearing in transmitted payloads.

mitigates

Classification identifies sensitive data so it is not inadvertently transmitted.

mitigates

Labelling makes sensitive data visible to developers and prevents accidental inclusion in outbound messages.

mitigates

Information-transfer rules directly govern what data may be sent to external parties.

mitigates

PII-protection requirements reduce the chance of sending personal data to unauthorized recipients.

mitigates

DLP controls inspect and block outbound flows that contain sensitive information.

References