GitLab Fixes 13 Security Flaws That Can Leak Data, Alter Pipelines, and Crash Servers

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

Spread the love

GitLab has released critical security updates to address 13 vulnerabilities that could potentially expose sensitive data, manipulate CI/CD pipelines, and disrupt server availability across Community Edition (CE) and Enterprise Edition (EE) deployments.

The latest patch versions, 19.2.1, 19.1.3, and 19.0.5, were released on July 29, 2026. These updates include fixes for high-, medium-, and low-severity issues.

GitLab strongly urges all self-managed users to upgrade immediately, as GitLab.com is already running the patched versions, and GitLab Dedicated customers do not need to take any action.

GitLab Fixes 13 Security Vulnerabilities

Among the most critical vulnerabilities is CVE-2026-6267, which has a high severity level and a CVSS score of 8.5. This flaw affects GitLab Workhorse and could allow authenticated users with Developer-level access to retrieve sensitive information in internal requests due to improper access control.

Another high-risk issue, CVE-2026-12436, allows attackers to exploit a mass-assignment flaw in the Pipeline Schedule API to modify CI/CD configurations belonging to other users, potentially leading to unauthorized pipeline executions.

GitLab has also addressed CVE-2026-15975, a denial-of-service vulnerability that unauthenticated attackers can exploit. By abusing insufficient resource throttling in merge request discussions, attackers may crash or significantly degrade server performance, affecting availability in production environments.

Several medium-severity vulnerabilities impact authorization and access control mechanisms. These include improper authorization in project import functionality, unauthorized access to pipeline test reports, and exposure of confidential issue titles through merge request metadata.

Additionally, a race condition in merge request approval rules could allow code to be merged into protected branches without the necessary approvals, posing a risk to software integrity.

The update also fixes a cross-site scripting issue that could allow the execution of malicious JavaScript through crafted URLs, as well as a prompt injection vulnerability in GitLab Duo Code Review, highlighting emerging risks in AI-assisted development tools. Another issue in Duo Workflows could allow the bypassing of governance controls due to incorrect token generation.

One example of a potential attack scenario involves a low-privilege developer exploiting a flaw in the Pipeline Schedule API to modify scheduled jobs in another project, thereby injecting malicious scripts into the CI/CD pipeline. This could lead to supply chain compromise, unauthorized deployments, or data exfiltration without immediate detection.

GitLab noted that all vulnerabilities will be publicly disclosed 90 days after patches are released, in line with responsible disclosure practices. The company emphasized that keeping installations up to date is critical to protecting sensitive code repositories and development workflows.

CVE ID Description Severity Edition
CVE-2026-6267 Workhorse sensitive information exposure High CE / EE
CVE-2026-12436 Pipeline Schedule API mass assignment High CE / EE
CVE-2026-15975 Merge Request Discussions denial of service (DoS) High CE / EE
CVE-2026-13113 Merge request approval rules race condition Medium EE
CVE-2026-16553 Virtual Registries credential protection flaw Medium EE
CVE-2026-6336 Project import status improper access control Medium CE / EE
CVE-2026-14341 Project import improper authorization Medium CE / EE
CVE-2026-3093 Cross-site scripting (XSS) in paginated views Medium CE / EE
CVE-2026-15077 Duo Code Review prompt injection Medium EE
CVE-2026-15831 Duo Workflows security token generation flaw Medium EE
CVE-2026-14351 Merge request title information exposure Medium CE / EE
CVE-2026-4672 Pipeline Test Report API improper access control Medium CE / EE
CVE-2025-14562 Merge request collaboration incorrect authorization Low CE / EE

The patch release includes database migrations, which may cause downtime for single-node deployments. However, multi-node environments can apply updates using zero-downtime upgrade procedures.

Security teams are advised to prioritize patching, review access controls, and audit CI/CD configurations to mitigate the risk of exploitation associated with these vulnerabilities.

 Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.