GitLab CE/EE: Cache poisoning of raw repository files via permissive regex
Summary
GitLab Community Edition and Enterprise Edition contain an issue in repository file access caused by improper validation of repository references. An authorized user can poison cached responses for raw repository files under certain conditions. Targeted CI/CD pipelines may then execute manipulated content and expose protected environment variables.
Affected
- GitLab CE/EE before 19.2.8
- GitLab CE/EE 19.3 before 19.3.5
- GitLab CE/EE 19.4 before 19.4.2
- GitLab.com and GitLab Dedicated were reported as already patched.
Fixed in
- 19.2.8
- 19.3.5
- 19.4.2
Released on October 12, 2026.
Workaround
Unknown.
Exploitation
- CISA SSVC: exploitation none, automatable no, technical impact total.
- No evidence of public exploitation or proof of concept found in the research.
Our recommendation
- Upgrade self-managed GitLab CE/EE to 19.2.8, 19.3.5, 19.4.2 or later as soon as possible.
- If GitLab was installed from a distribution repository, move to the official Omnibus packages, as the distribution may not provide a fix.
- Review CI/CD variables and protected environments for exposure, and restrict who can push to repositories used by protected pipelines.
- Monitor pipeline logs for unexpected changes in executed content.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitLab Critical Patch Release: 19.4.2, 19.3.5, 19.2.8 docs.gitlab.com
- GitLab issue 604950 gitlab.com
- HackerOne report 3832707 hackerone.com
- Ubuntu security notice CVE-2026-14814 ubuntu.com
- VulDB entry 417445 vuldb.com
- Vulners NVD record CVE-2026-14814 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 16:32.
Original description (NVD)
GitLab has remediated an issue in GitLab CE/EE affecting all versions before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed a user to poison cached responses for raw repository files, causing targeted users' CI/CD pipelines to execute specially crafted content and potentially exposing protected environment variables, due to improper validation of repository references.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.