CVE-2025-10094
📋 TL;DR
Authenticated users in GitLab can create tokens with excessively large names, causing disruption to token listing and administrative operations. This affects GitLab CE/EE instances running vulnerable versions, potentially impacting administrators' ability to manage tokens.
💻 Affected Systems
- GitLab Community Edition
- GitLab Enterprise Edition
📦 What is this software?
Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →⚠️ Risk & Real-World Impact
Worst Case
Denial of service affecting token management functionality, preventing administrators from viewing, managing, or revoking tokens, potentially leading to operational disruption.
Likely Case
Temporary disruption to token listing pages and administrative interfaces, requiring manual intervention or restart to restore functionality.
If Mitigated
Minimal impact with proper access controls limiting who can create tokens and monitoring for abnormal token creation patterns.
🎯 Exploit Status
Exploitation requires authenticated access but is technically simple - just creating a token with a very large name.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 18.1.6, 18.2.6, or 18.3.2
Vendor Advisory: https://about.gitlab.com/releases/2025/09/10/patch-release-gitlab-18-3-2-released/
Restart Required: No
Instructions:
1. Backup your GitLab instance. 2. Update to GitLab 18.1.6, 18.2.6, or 18.3.2 depending on your current version. 3. Verify the update completed successfully.
🔧 Temporary Workarounds
Restrict token creation permissions
allLimit which users can create tokens to trusted administrators only
Monitor token creation
allImplement monitoring for unusually large token names or excessive token creation
🧯 If You Can't Patch
- Restrict token creation to administrators only
- Implement rate limiting on token creation endpoints
🔍 How to Verify
Check if Vulnerable:
Check GitLab version via admin interface or command lineCheck Version:
sudo gitlab-rake gitlab:env:info | grep VersionVerify Fix Applied:
Verify version is 18.1.6, 18.2.6, or 18.3.2 or later📡 Detection & Monitoring
Log Indicators:
- Unusually large token names in audit logs
- Multiple token creation attempts from single user
Network Indicators:
- Increased API calls to token creation endpoints
SIEM Query:
source="gitlab" AND (event="token_created" AND token_name.length > 1000)