AIKIDO-2026-523251

TL;DR

When dynamic API URLs are enabled, the server reads the X-GitLab-API-URL request header and uses it as the base URL for outbound GitLab API calls, validating only that the value is a syntactically valid URL with no host allowlist. The server attaches the caller's Private-Token to those outbound requests, so any caller reaching the HTTP transport can point the header at an attacker-controlled host and receive the victim's GitLab token in a single request. With the stolen token the actor gains full GitLab API access at the victim's permission level, including reading and writing repositories, pipelines, and CI/CD secrets. The fix validates the header host against a configurable allowlist before it is used.