SB2026101301 - Multiple vulnerabilities in GitLab CE/EE
Published: October 13, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 24 vulnerabilities.
1) Incorrect authorization (CVE-ID: CVE-2026-14552)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to read confidential epic content restricted by external authorization.
The vulnerability exists due to incorrect authorization checks in the work items GraphQL API when handling requests for epic content. A remote user can request epic content through the work items GraphQL API to read confidential epic content restricted by external authorization.
Exploitation requires Guest access.
2) Permissive Regular Expression (CVE-ID: CVE-2026-14814)
CWE-ID: CWE-625 - Permissive Regular Expression
CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to poison cached responses for raw repository files.
The vulnerability exists due to improper validation of repository references. A remote user can poison cached responses for raw repository files, causing targeted users’ CI/CD pipelines to execute specially crafted content and potentially exposing protected environment variables.
3) Cross-site scripting (CVE-ID: CVE-2026-92883)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows a remote user to execute arbitrary JavaScript in other users' browser sessions.
The vulnerability exists due to cross-site scripting caused by improper sanitization of HTML attributes in syntax-highlighting output when rendering repository content. A remote user can supply a specially crafted repository to execute arbitrary JavaScript in other users' browser sessions.
User interaction is required.
4) Incorrect authorization (CVE-ID: CVE-2026-16301)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute CI/CD pipelines on protected branches without authorization.
The vulnerability exists due to improper authorization checks in the downstream pipeline creation service when creating downstream pipelines. A remote user can use the downstream pipeline creation service to execute CI/CD pipelines on protected branches without authorization.
Exploitation requires the Developer role.
5) Incorrect authorization (CVE-ID: CVE-2026-81839)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary CI/CD pipelines in a transferred project with the new group's privileges.
The vulnerability exists due to incorrect authorization caused by improper cleanup of scheduled pipeline execution policy records in scheduled pipeline execution policies when a project is transferred. A remote user can use retained scheduled pipeline execution policy records to execute arbitrary CI/CD pipelines in a transferred project with the new group's privileges.
User interaction is required.
6) Improper neutralization of input used for LLM prompting (CVE-ID: CVE-2026-96893)
CWE-ID: -
CVSSv4: 8.4 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to potentially cause unintended command execution attributed to other users.
The vulnerability exists due to improper neutralization of input used for LLM prompting in GitLab Duo Agent Platform when constructing AI conversation context. A remote user can inject specially crafted content into AI agent instructions to potentially cause unintended command execution attributed to other users.
User interaction is required.
7) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2026-101168)
CWE-ID: CWE-532 - Information Exposure Through Log Files
CVSSv4: 6.8 [CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote privileged user to obtain access tokens and other secrets.
The vulnerability exists due to insertion of sensitive request data into log files and error tracking events in GitLab Pages when logging requests and recording errors. A remote privileged user can read GitLab Pages log data to obtain access tokens and other secrets.
Exploitation requires access to GitLab Pages log data and an adjacent-network attack position.
8) Open redirect (CVE-ID: CVE-2026-7767)
CWE-ID: CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
CVSSv4: 5.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive authentication tokens to an unintended server.
The vulnerability exists due to improper redirect validation in the Kubernetes proxy when handling redirects. A remote user can use a controlled Kubernetes agent to cause tokens to be sent to an unintended server to disclose sensitive authentication tokens.
User interaction is required.
9) Incorrect authorization (CVE-ID: CVE-2026-16275)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to read confidential notes on public projects.
The vulnerability exists due to incorrect authorization checks in the GraphQL notes widget when handling requests for project notes. A remote attacker can request confidential notes through the GraphQL notes widget to read confidential notes on public projects.
10) Incorrect authorization (CVE-ID: CVE-2026-84284)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to read work item contents from private groups and projects.
The vulnerability exists due to incorrect authorization checks in the GraphQL work item hierarchy when handling work item requests. A remote attacker can request work item contents through the GraphQL work item hierarchy to read work item contents from private groups and projects.
11) Incorrect authorization (CVE-ID: CVE-2026-85529)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to read internal notes and confidential system notes on public projects.
The vulnerability exists due to improper authorization in the GraphQL API's note scope handling when processing requests for project notes. A remote attacker can request notes through the GraphQL API to read internal notes and confidential system notes on public projects.
12) Use of Incorrectly-Resolved Name or Reference (CVE-ID: CVE-2026-100755)
CWE-ID: CWE-706 - Use of Incorrectly-Resolved Name or Reference
CVSSv4: 2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to poison cached page content served to other users.
The vulnerability exists due to improper cache key construction in merge request page caching when caching and serving page content. A remote user can exploit the improperly constructed cache keys to poison cached page content served to other users.
Exploitation depends on certain deployment configurations and requires user interaction; the advisory does not specify those configurations.
13) Incorrect Privilege Assignment (CVE-ID: CVE-2026-104661)
CWE-ID: CWE-266 - Incorrect Privilege Assignment
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute a specially crafted compliance pipeline across group projects.
The vulnerability exists due to incorrect privilege assignment in custom roles when granting compliance framework administration permissions. A remote user can configure a specially crafted compliance pipeline to execute it across group projects.
Exploitation requires a custom role with compliance framework administration permissions.
14) Integer overflow (CVE-ID: CVE-2026-97229)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code on the GitLab server.
The vulnerability exists due to integer overflow in the CI/CD regular expression compiler when processing regular expressions in CI/CD configurations. A remote attacker can supply a specially crafted regular expression in a CI/CD configuration to execute arbitrary code on the GitLab server.
15) Insufficient Granularity of Access Control (CVE-ID: CVE-2026-14210)
CWE-ID: CWE-1220 - Insufficient Granularity of Access Control
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to permanently delete or modify group-level labels.
The vulnerability exists due to insufficient granularity of access control in project label management when validating label ownership scope. A remote user can use a project-scoped fine-grained personal access token to permanently delete or modify group-level labels.
16) Reliance on Untrusted Inputs in a Security Decision (CVE-ID: CVE-2026-105458)
CWE-ID: CWE-807 - Reliance on Untrusted Inputs in a Security Decision
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to obtain a GitLab Duo Agent Platform token that bypasses governance controls.
The vulnerability exists due to reliance on untrusted input in a security decision in GitLab Duo Agent Platform when authorizing token issuance. A remote user can exploit the token issuance decision to obtain a GitLab Duo Agent Platform token that bypasses governance controls.
Exploitation requires a specific granular permission that the advisory does not identify.
17) Incorrect authorization (CVE-ID: CVE-2026-5954)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to download package files from a public project without proper authorization.
The vulnerability exists due to improper authorization checks in the package registry when handling package file download requests. A remote user can request package files from the package registry to download package files from a public project without proper authorization.
18) Incorrect authorization (CVE-ID: CVE-2026-92528)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to approve a merge request despite having contributed commits to it.
The vulnerability exists due to incorrect authorization caused by improper identity resolution in the merge request approval eligibility check when determining whether a contributor may approve a merge request. A remote user can bypass the contributor eligibility check to approve a merge request despite having contributed commits to it.
19) Incorrect authorization (CVE-ID: CVE-2026-78335)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to modify group integrations outside a personal access token's scope.
The vulnerability exists due to incorrect authorization checks in fine-grained personal access token handling when authorizing changes to group integrations. A remote user can use a project-scoped fine-grained personal access token to modify group integrations outside the token's scope.
20) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-100104)
CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to reach internal network resources through server-side request forgery.
The vulnerability exists due to a time-of-check to time-of-use race condition in repository import URL validation when processing repository import operations. A remote user can exploit the URL validation race during repository import to reach internal network resources through server-side request forgery.
21) Incorrect authorization (CVE-ID: CVE-2026-82632)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to import projects into group namespaces beyond a personal access token's intended scope.
The vulnerability exists due to incorrect authorization of the import target namespace in project import when processing project imports. A remote user can use a fine-grained personal access token scoped only to user-boundary import permissions to import projects into group namespaces beyond the token's intended scope.
22) Incorrect authorization (CVE-ID: CVE-2026-103549)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote privileged user to remove package registry metadata restricted by package protection rules.
The vulnerability exists due to improper authorization checks in the package registry when handling metadata removal operations. A remote privileged user can perform metadata removal operations to remove package registry metadata restricted by package protection rules.
Maintainer-role permissions are sufficient even when the applicable protection rules reserve the operation for higher roles.
23) Improper access control (CVE-ID: CVE-2026-9268)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote privileged user to modify project CI/CD deployment rollback settings without proper authorization.
The vulnerability exists due to insufficient access control checks in project CI/CD settings when handling deployment rollback setting changes. A remote privileged user can submit deployment rollback setting changes to modify project CI/CD deployment rollback settings without proper authorization.
24) Missing Authorization (CVE-ID: CVE-2026-6567)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to read restricted CI artifact report content without authorization.
The vulnerability exists due to missing authorization checks in the merge request accessibility report comparison endpoint when handling report comparison requests. A remote user can request report content through the comparison endpoint to read restricted CI artifact report content without authorization.
Exploitation requires the Reporter role.
Remediation
Install update from vendor's website.