Bytebase versions 0.12.0 up to but not including 1.0.1 trust client-supplied GitLab provider settings during login, so an unauthenticated attacker can get a valid session as any user, including the Owner.
What Is It
CVE-2022-51026 is an authentication bypass in Bytebase, an open-source tool written in Go, and it is classified as CWE-290 (Authentication Bypass by Spoofing). The bug is in the POST /api/auth/login/GITLAB_SELF_HOST endpoint, which accepts GitLab provider configuration from the client and trusts it. An attacker sets instanceUrl to a server they control. That server answers with an active user and an email address of the attacker's choosing. Bytebase then issues session tokens for that user.
Why It Matters
The attacker needs no credentials and no user interaction. They can impersonate existing accounts, including the Owner, or create new members. That gives them whatever access the hijacked account has inside Bytebase.
VulnCheck scored it CVSS 3.1 9.8 (Critical) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and CVSS 4.0 9.3 (Critical). The network attack vector and low attack complexity come from the CVSS 3.1 vector (AV:N, AC:L), not from the severity scores. That vector also records that no privileges (PR:N) and no user interaction (UI:N) are required.
The CISA Known Exploited Vulnerabilities (KEV) catalog has no entry for this CVE at the time of writing, so KEV does not confirm active exploitation in the wild. NVD lists the record as "Received", published 2026-10-22.
What's Vulnerable
- Product: Bytebase (
pkg:golang/github.com/bytebase/bytebase) - Affected: 0.12.0 up to but not including 1.0.1
- Unaffected: 1.0.1 and later
The vulnerable logic is in server/auth.go in the 1.0.0 release, lines 79-93.
Patch Status
The fix shipped in Bytebase 1.0.1. It is linked to pull request #834 and commit d69e682. There is no KEV entry, so no CISA-mandated required action or due date applies. Organizations running Bytebase 0.12.0 through 1.0.0 should upgrade to 1.0.1 or later. Admins should also check whether any user accounts were added or used unexpectedly on exposed instances.
Sources
- NVD – CVE-2022-51026
- CISA Known Exploited Vulnerabilities Catalog
- VulnCheck Advisory – Bytebase 0.12.0 before 1.0.1 Authentication Bypass via GitLab Self-Hosted Login
- GitHub Security Advisory GHSA-5r3p-6rj5-7937
- Bytebase 1.0.1 Release
- Fix Commit d69e682
- Bytebase Pull Request #834
- Vulnerable Code – server/auth.go (1.0.0)
- Bytebase GitHub Repository