CVE-2026-16301

HIGH

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with Developer role to execute CI/CD pipelines on protected branches without authorization due to improper authorization checks in the downstream pipeline creation service.

CVSS v3.1 Score

8.5
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N
Attack Vector
NETWORK
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality
LOW
Integrity
HIGH
Availability
NONE
Published: 10/13/2026Modified: 10/14/2026

Related Intelligence (1)

CRITICALAi

GitLab patches a max-severity regex flaw alongside five high-severity bugs

GitLab just fixed a max-severity vulnerability that could allow unauthenticated attackers to execute arbitrary code on its servers. The company released a fix on Monday, alongside patches for five other high-severity flaws affecting its source code management and continuous integration and delivery (CI/CD) platform. The vulnerability, tracked as CVE-2026-97229 , was fixed in versions 19.4.2, 19.3.

CVE-2026-97229CVE-2026-92883
CSO Online

References (3)

https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/Release NotesVendor Advisoryhttps://gitlab.com/gitlab-org/gitlab/-/work_items/606501Issue Trackinghttps://hackerone.com/reports/3853866Permissions Required