CVE-2026-19228
HighCVSS 8.5Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to cause AI usage to be attributed to another namespace, due to improper authorization of identity information supplied in requests.
Risk Assessment
Risk of incorrect attribution of AI usage to another namespace, potentially leading to billing issues or isolation breach.
Recommendation
Update GitLab EE to version 19.1.4 or 19.2.2 (or later), which includes the fix.
Original NVD description (English source)
GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to cause AI usage to be attributed to another namespace, due to improper authorization of identity information supplied in requests.