GHSA-p3v4-c93g-cmhwMediumCVSS 4.7

BBOT's gitlab.py exposes globally configured "gitlab" API key

Published
October 27, 2025
Last Modified
October 27, 2025

🔗 CVE IDs covered (1)

CVE-2025-10282 →

📋 Description

Summary

bbot's gitlab.py sends the user's "gitlab" API key to on-premise GitLab instances.

If a user has configured a gitlab.com API key using this mechanism, it may be leaked to an attacker-controlled server.

Impact

A user with a "gitlab" API key configured who uses bbot to scan a malicious webserver may leak their gitlab.com API key to an untrustworthy server.

🎯 Affected products2

  • pip/bbot:< 2.7.0
  • pip/bbot:>= 2.7.0.6919rc0, < 2.7.2

🔗 References (4)