CVE-2023-0326 Information disclosure in GitLab DAST API scanner

Medium 5.0 Published 27 Mar 2023 Updated 19 Feb 2025

Attackers can view leaked Authorization headers in vulnerability reports, exposing sensitive credentials to anyone with report access.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-0326?

CVE-2023-0326 is a medium-severity vulnerability in GitLab DAST API scanner, published on 27 Mar 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

An issue has been discovered in GitLab DAST API scanner affecting all versions starting from 1.6.50 before 2.11.0, where Authorization headers was leaked in vulnerability report evidence.

Which versions are affected by CVE-2023-0326?

It affects 1 product.

Products include Gitlab Dynamic Application Security Testing Analyzer.

How do I fix CVE-2023-0326?

No fix has been published for CVE-2023-0326 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-0326 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-0326 exists.

Sources

Also known as CVE-2023-1648, GHSA-5885-hj3c-73cr.