GitLab CE/EE: Incorrect authorization in downstream pipeline creation service
Summary
A flaw in the downstream pipeline creation service of GitLab CE/EE allows an authenticated user with the Developer role to run CI/CD pipelines on protected branches without authorization. Protected branches often deploy to production, so a malicious or compromised developer account could affect production systems. The advisory does not describe an anonymous attack path, and the attacker needs a valid account.
Affected
- GitLab CE/EE from 18.7 before 19.2.8
- GitLab CE/EE from 19.3 before 19.3.5
- GitLab CE/EE from 19.4 before 19.4.2
- Default configuration is unaffected according to the CVE record.
Fixed in
- Upgrade to GitLab 19.2.8, 19.3.5, 19.4.2 or later.
- Fixes were released on 12 October 2026 in the GitLab Critical Patch Release.
- The research notes list later patch releases (for example 19.4.5 and 19.3.7). These also contain other fixes, so the newest patch in your release branch is advisable.
Workaround
Unknown.
Exploitation
- The vendor and the CISA SSVC assessment list no known exploitation (Exploitation: none, Automatable: no).
- The CISA KEV status and public proof-of-concept status were not verified against primary sources.
- Do not confuse this CVE with CVE-2026-97229, a separate GitLab flaw that is reported as exploited.
Our recommendation
- Upgrade self-managed GitLab to the newest patch release of your branch as soon as possible. Single-node installations will have downtime during the database migrations.
- Patch CVE-2026-97229 at the same time, since it is in the same patch release.
- Review pipeline history for protected branches and look for pipelines you cannot explain, especially those started by Developer accounts.
- Review Developer and contractor accounts and disable unused accounts. Check whether self-registration is enabled.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitLab Critical Patch Release 19.4.2, 19.3.5, 19.2.8 docs.gitlab.com
- GitLab work item 606501 gitlab.com
- HackerOne report 3853866 hackerone.com
- Ubuntu CVE-2026-16301 ubuntu.com
- Vulners NVD CVE-2026-16301 vulners.com
- ISitPatched GitLab vulnerabilities isitpatched.com
- The Hacker Wire CVE-2026-16301 www.thehackerwire.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 10:46.
Original description (NVD)
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with Developer role to execute CI/CD pipelines on protected branches without authorization due to improper authorization checks in the downstream pipeline creation service.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.