CVE-2025-10282

GitLab Domain Confusion in gitlab Leaks API Key

4.7 MediumFix available

CVE-2025-10282 is a medium vulnerability (CVSS 4.7) in Blsops, Llc Bbot, published October 9, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.23%, the 13th percentile. Fixed in bbot 2.7.0.

BBOT's gitlab module could be abused to disclose a GitLab API key to an attacker controlled server with a malicious formatted git URL.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: None
Availability: None

Exploit likelihood

0.23%Up 0.2 points since Oct 10, 2025

What each source reports

CVE List Score used 4.7

GitLab Domain Confusion in gitlab Leaks API Key

BBOT's gitlab module could be abused to disclose a GitLab API key to an attacker controlled server with a malicious formatted git URL.

Record: CVE-2025-10282
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

EUVDEUVD-2025-33395 4.7

BBOT's gitlab module could be abused to disclose a GitLab API key to an attacker controlled server with a malicious formatted git URL.

Record: EUVD-2025-33395
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-p3v4-c93g-cmhw 4.7

BBOT's gitlab.py exposes globally configured "gitlab" API key

Summary

bbot's gitlab.py sends the user's "gitlab" API key to on-premise GitLab instances.

If a user has configured a gitlab.com API key using this mechanism, it may be leaked to an attacker-controlled server.

Impact

A user with a "gitlab" API key configured who uses bbot to scan a malicious webserver may leak their gitlab.com API key to an untrustworthy server.

Record: GHSA-p3v4-c93g-cmhw
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

NVD 4.7

BBOT's gitlab module could be abused to disclose a GitLab API key to an attacker controlled server with a malicious formatted git URL.

Record: CVE-2025-10282
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

OSVGHSA-p3v4-c93g-cmhw 4.7

BBOT's gitlab.py exposes globally configured "gitlab" API key

Summary

bbot's gitlab.py sends the user's "gitlab" API key to on-premise GitLab instances.

If a user has configured a gitlab.com API key using this mechanism, it may be leaked to an attacker-controlled server.

Impact

A user with a "gitlab" API key configured who uses bbot to scan a malicious webserver may leak their gitlab.com API key to an untrustworthy server.

Record: GHSA-p3v4-c93g-cmhw
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

OSVPYSEC-2026-1217 4.7

BBOT's gitlab.py exposes globally configured "gitlab" API key

Summary

bbot's gitlab.py sends the user's "gitlab" API key to on-premise GitLab instances.

If a user has configured a gitlab.com API key using this mechanism, it may be leaked to an attacker-controlled server.

Impact

A user with a "gitlab" API key configured who uses bbot to scan a malicious webserver may leak their gitlab.com API key to an untrustworthy server.

Record: PYSEC-2026-1217
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
Updated: 2026-11-02

Affected products

blsops, llc bbot

Affected packages

Affected packages
Package	Affected	Fixed
`bbot` PyPI	before 2.7.0	2.7.0
`bbot` PyPI	2.7.0.6919rc0 up to 2.7.2	2.7.2
`bbot` PyPI	before 2.7.2, plus listed versions 1.0.01.0.11.0.21.0.31.0.3.512 Show 45 moreShow less 1.0.3.5211.0.3.5451.0.3.5831.0.3.6961.0.3.7771.0.3.7801.0.3.9191.0.4.1132rc01.0.4.1134rc01.0.4.1139rc01.0.4.1141rc01.0.4.1147rc01.0.4.1156rc01.0.4.1158rc01.0.4.1160rc01.0.4.1162rc01.0.4.1164rc01.0.4.1166rc01.0.4.1168rc01.0.4.1170rc01.0.4.1173rc01.0.4.1175rc01.0.4.1177rc01.0.4.1183rc01.0.4.1185rc01.0.4.1193rc01.0.4.1197rc01.0.4.1199rc01.0.4.1233rc01.0.4.1235rc01.0.4.1237rc01.0.4.1242rc01.0.4.1262rc01.0.4.1266rc01.0.4.1269rc01.0.4.1272rc01.0.4.1276rc01.0.4.1279rc01.0.4.1285rc01.0.4.1303rc01.0.4.1306rc01.0.4.1310rc01.0.4.9221.0.5.1313rc01.0.5.1317rc0	2.7.2
`bbot` PyPI	2.7.0.6919rc0 up to 2.7.2, plus listed versions 2.7.0.6925rc02.7.0.6930rc02.7.0.6932rc02.7.0.6948rc02.7.0.6962rc0 Show 30 moreShow less 2.7.0.6989rc02.7.0.6995rc02.7.0.7002rc02.7.0.7010rc02.7.0.7014rc02.7.0.7023rc02.7.0.7027rc02.7.0.7090rc02.7.0.7092rc02.7.0.7094rc02.7.0.7096rc02.7.0.7098rc02.7.0.7100rc02.7.0.7108rc02.7.0.7112rc02.7.0.7116rc02.7.0.7136rc02.7.12.7.1.7141rc02.7.1.7149rc02.7.1.7151rc02.7.1.7153rc02.7.1.7159rc02.7.1.7167rc02.7.1.7169rc02.7.1.7175rc02.7.1.7198rc02.7.1.7202rc02.7.1.7207rc02.7.1.7212rc0	2.7.2

History

History
When	Changed	Sources
2026-11-02	created	CVE List, EUVD, GitHub Advisories, NVD, OSV

References

This page doesn't list everything

Left out here: 612 versions. The JSON record has them.