{"metadata": {"vulnerability": "CVE-2026-112212", "count": 27, "kinds": {"milestone": 8, "sighting": 5, "kev": 0, "other": 14}}, "data": [{"timestamp": "2025-08-04T16:30:00Z", "date_only": false, "value": "2025-08-04T16:30:00Z", "kind": "other", "label": "Document generated", "source": "csaf_ncscnl \u00b7 NCSC-2026-0447", "record": "NCSC-2026-0447", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-10-19T10:34:06.433Z", "date_only": false, "value": "2026-10-19T10:34:06.433Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-112212", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-21T00:00:00Z", "date_only": true, "value": "2026-10-21", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1363", "record": "CERTFR-2026-AVI-1363", "field": "vendor_advisories.0.published_at", "linked_record": true}, {"timestamp": "2026-10-21T18:00:00Z", "date_only": false, "value": "2026-10-21T18:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.hkcert.org/security-bulletin/gitlab-multiple-vulnerabilities_20261022", "record": "CVE-2026-112212", "field": "creation_timestamp", "uuid": "d1285e37-ee21-4c60-a90a-4a63778616b3", "url": "https://www.hkcert.org/security-bulletin/gitlab-multiple-vulnerabilities_20261022"}, {"timestamp": "2026-10-21T23:33:45.429Z", "date_only": false, "value": "2026-10-21T23:33:45.429Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-112212", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-21T23:33:45.429Z", "date_only": false, "value": "2026-10-21T23:33:45.429Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitLab", "record": "CVE-2026-112212", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-21T23:48:15.789Z", "date_only": false, "value": "2026-10-21T23:48:15.789694Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117481569432599956", "record": "CVE-2026-112212", "field": "creation_timestamp", "uuid": "d7d2929c-c7b3-4f99-af31-889070ba363b", "content": "CVE-2026-112212 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in GitLab GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, an unauthenticated user could have poisoned a shared cache's OAuth/OIDC discovery document to redirect certain flows to an externally controlled server, due to improper trust of user-supplied values when constructing endpoint URLs in cached discovery responses.\nhttps://www.cve.org/CVERecord?id=CVE-2026-112212https://gitlab.com/gitlab-org/gitlab/-/work_items/627499https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/#gitlab #GitLab#CVE_2026_112212#bot", "url": "https://infosec.exchange/users/cve/statuses/117481569432599956"}, {"timestamp": "2026-10-22T00:00:00Z", "date_only": false, "value": "2026-10-22T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1363", "record": "CERTFR-2026-AVI-1363", "field": "last_revision_date", "linked_record": true}, {"timestamp": "2026-10-22T00:00:00Z", "date_only": false, "value": "2026-10-22T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1363", "record": "CERTFR-2026-AVI-1363", "field": "initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-22T00:00:00Z", "date_only": false, "value": "2026-10-22T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1363", "record": "CERTFR-2026-AVI-1363", "field": "revisions.0.revision_date", "linked_record": true}, {"timestamp": "2026-10-22T01:16:57Z", "date_only": false, "value": "2026-10-22T01:16:57Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-F887-CHXW-8674", "record": "GHSA-F887-CHXW-8674", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-10-22T01:16:57.740Z", "date_only": false, "value": "2026-10-22T01:16:57.740", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-112212", "record": "FKIE_CVE-2026-112212", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-22T02:12:12Z", "date_only": false, "value": "2026-10-22T02:12:12.000000Z", "kind": "sighting", "label": "Seen", "source": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0447", "record": "CVE-2026-112212", "field": "creation_timestamp", "uuid": "bfc5b005-e835-48bf-b9f1-ae9c598c2aac", "url": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0447"}, {"timestamp": "2026-10-22T03:33:33Z", "date_only": false, "value": "2026-10-22T03:33:33Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-F887-CHXW-8674", "record": "GHSA-F887-CHXW-8674", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-22T03:33:33Z", "date_only": false, "value": "2026-10-22T03:33:33Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-F887-CHXW-8674", "record": "GHSA-F887-CHXW-8674", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-22T07:12:12Z", "date_only": false, "value": "2026-10-22T07:12:12.000000Z", "kind": "sighting", "label": "Seen", "source": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0447", "record": "CVE-2026-112212", "field": "creation_timestamp", "uuid": "b7d443ee-9614-4af6-8311-761717a1de46", "content": "GitLab heeft 12 kwetsbaarheden verholpen in GitLab Community Edition (CE) en Enterprise Edition (EE). E\u00e9n kwetsbaarheid is als kritiek aangemerkt.\n\n\nGitLab heeft een kwetsbaarheid verholpen in GitLab Community Edition en Enterprise Edition binnen de versies vanaf 7.0 tot bepaalde 19.x releases. De kwetsbaarheid met kenmerk CVE-2026-110264 heeft een CVSS-score van 10,0 en betreft een integer overflow bij het compileren van een speciaal vervaardigde reguliere expressie. Onder bepaalde omstandigheden kan een niet-geauthenticeerde kwaadwillende de kwetsbaarheid op afstand misbruiken  om willekeurige code op de GitLab-serveruit te voeren. De kwetsbaarheid treft GitLab-versies vanaf 7.0.\n\nDe kwetsbaarheden met kenmerk CVE-2026-15723 en CVE-2026-112212 zijn als High aangemerkt. CVE-2026-15723 kan door een geauthenticeerd aanvaller bij specifieke SAML- en LDAP-configuraties leiden tot overname van een bestaand account. CVE-2026-112212 betreft cache poisoning in OAuth/OIDC-discovery-endpoints en kan bepaalde authenticatiestromen omleiden naar een door een kwaadwillende beheerde server. De overige kwetsbaarheden kunnen onder meer leiden tot ongeautoriseerde toegang tot informatie en het omzeilen van toegangs- en beveiligingscontroles.\n\nGitLab heeft twee detectieregels gepubliceerd waarmee beheerders van self-managed GitLab-installaties kunnen zoeken naar mogelijke exploitatiepogingen van CVE-2026-110264. GitLab meldt vooralsnog geen actief misbruik van de kwetsbaarheid.", "url": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0447"}, {"timestamp": "2026-10-22T09:12:12.147Z", "date_only": false, "value": "2026-10-22T09:12:12.147880Z", "kind": "other", "label": "Advisory revision", "source": "csaf_ncscnl \u00b7 NCSC-2026-0447", "record": "NCSC-2026-0447", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-10-22T09:12:12.147Z", "date_only": false, "value": "2026-10-22T09:12:12.147880Z", "kind": "milestone", "label": "Published", "source": "csaf_ncscnl \u00b7 NCSC-2026-0447", "record": "NCSC-2026-0447", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-22T09:12:12.147Z", "date_only": false, "value": "2026-10-22T09:12:12.147880Z", "kind": "other", "label": "Updated", "source": "csaf_ncscnl \u00b7 NCSC-2026-0447", "record": "NCSC-2026-0447", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-10-22T21:00:00Z", "date_only": false, "value": "2026-10-22T21:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=2133", "record": "CVE-2026-112212", "field": "creation_timestamp", "uuid": "4b103c76-eabd-4cb8-9ade-af12c17fae65", "url": "https://www.govcert.gov.hk/en/alerts_detail.php?id=2133"}, {"timestamp": "2026-10-29T09:10:15.443Z", "date_only": false, "value": "2026-10-29T09:10:15.443Z", "kind": "milestone", "label": "Published", "source": "bitnami_vulndb \u00b7 BIT-GITLAB-2026-112212", "record": "BIT-GITLAB-2026-112212", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-29T09:16:42.832Z", "date_only": false, "value": "2026-10-29T09:16:42.832Z", "kind": "other", "label": "Updated", "source": "bitnami_vulndb \u00b7 BIT-GITLAB-2026-112212", "record": "BIT-GITLAB-2026-112212", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-30T17:32:37.930Z", "date_only": false, "value": "2026-10-30T17:32:37.930476Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-112212", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-30T17:32:37.930Z", "date_only": false, "value": "2026-10-30T17:32:37.930476Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-112212", "record": "FKIE_CVE-2026-112212", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2026-10-30T17:33:45.464Z", "date_only": false, "value": "2026-10-30T17:33:45.464Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-112212", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-30T17:33:45.464Z", "date_only": false, "value": "2026-10-30T17:33:45.464Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-112212", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-30T18:17:20.770Z", "date_only": false, "value": "2026-10-30T18:17:20.770", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-112212", "record": "FKIE_CVE-2026-112212", "field": "lastModified", "linked_record": true}], "metrics": {"as_of": "2026-11-03T10:36:40.326Z", "anchors": {"origin": {"timestamp": "2026-10-21T23:33:45.429Z", "date_only": false, "value": "2026-10-21T23:33:45.429Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-112212", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-21T23:33:45.429Z", "date_only": false, "value": "2026-10-21T23:33:45.429Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-112212", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 1076574.897371, "hours": 299.04858260305554, "days": 12.460357608460647, "min_seconds": 1076574.897371, "max_seconds": 1076574.897371, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-21T23:33:45.429Z", "date_only": false, "value": "2026-10-21T23:33:45.429Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-112212", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-03T10:36:40.326Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}