Executive brief
GitLab CE/EE contains a race condition vulnerability in its pipeline creation mechanism that could allow a developer to execute actions within another user's merge request pipeline context. This could enable unauthorized code execution or access to sensitive build artifacts and environment variables, potentially compromising the integrity of the CI/CD process.
Technical details
The vulnerability is a race condition in the merge request pipeline creation logic affecting GitLab CE/EE versions 13.0 through 19.3.1. A developer-level user can exploit a timing window during pipeline initialization to perform actions in the context of another user's merge request commit. The attack requires authenticated access (developer role) and network access to the GitLab instance. Successful exploitation allows an attacker to manipulate pipeline execution, potentially accessing protected CI/CD variables or triggering unauthorized build jobs. Patches have been released in versions 19.1.8, 19.2.6, and 19.3.2.
Affected products
- GitLab GitLab CE/EE 13.0 before 19.1.8, 19.2 before 19.2.6, 19.3 before 19.3.2
Timeline
- 2026-09-16: disclosed
- 2026-09-10: patched: Patches released in GitLab CE/EE versions 19.1.8, 19.2.6, and 19.3.2