Executive brief
GitLab is a development platform used by organizations to manage code repositories and automate deployments via CI/CD pipelines. An authenticated user could bypass environment scope restrictions to access CI/CD variables (such as credentials and secrets) that should have been isolated to other environments. This could allow an attacker with legitimate access to exfiltrate sensitive deployment credentials.
Technical details
The vulnerability exists in GitLab CE/EE's CI/CD variable scope enforcement mechanism due to improper input validation in the environment scope pattern matcher. An authenticated user can exploit the flawed pattern matching logic to access CI/CD variables outside their intended environment scope. The attack requires authentication but does not require elevated privileges or user interaction beyond normal GitLab access. Successful exploitation allows an attacker to read sensitive environment-scoped variables they should not have access to. Patches are available in versions 19.1.8, 19.2.6, and 19.3.2.
Affected products
- GitLab GitLab CE 15.7 before 19.1.8, 19.2 before 19.2.6, 19.3 before 19.3.2
- GitLab GitLab EE 15.7 before 19.1.8, 19.2 before 19.2.6, 19.3 before 19.3.2
Timeline
- 2026-09-15: disclosed
- 2026-09-15: patched: Patches available in versions 19.1.8, 19.2.6, and 19.3.2