CVE-2026-16301

High8.5 Published on Oct 13, 2026

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with Developer role to execute CI/CD pipelines on protected branches without authorization due to improper authorization checks in the downstream pipeline creation service.

CVSS score8.5 / 10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N

Weakness type (CWE)CWE-863

Vulnerabilities

GitLab Fixes CVSS 10.0 CI/CD Flaw Enabling Unauthenticated Server Code Execution

GitLab patched CVE-2026-97229, a CVSS 10.0 CI/CD flaw that could allow unauthenticated code execution via crafted regex, plus three high-severity fixes.

Oct 13, 202612:09 4 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database

CVE-2026-16301

Related articles

GitLab Fixes CVSS 10.0 CI/CD Flaw Enabling Unauthenticated Server Code Execution

Audience measurement