CVE-2026-12436: GitLab Auth Bypass Vulnerability

CVE-2026-12436 Overview

CVE-2026-12436 is a high-severity vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE). The flaw stems from improper validation of user-supplied attributes when processing pipeline schedule inputs. An authenticated user can modify Continuous Integration/Continuous Delivery (CI/CD) configuration belonging to another user under certain conditions. GitLab tracks the underlying weakness as CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes. The issue affects versions 18.0 through 19.2.1 across three release branches. GitLab patched the vulnerability in versions 19.0.5, 19.1.3, and 19.2.1.

Critical Impact
Authenticated attackers can tamper with another user's CI/CD pipeline configuration, enabling unauthorized code execution paths and integrity compromise within DevOps workflows.

Affected Products

GitLab CE/EE versions 18.0 through 19.0.4
GitLab CE/EE versions 19.1 through 19.1.2
GitLab CE/EE versions 19.2 through 19.2.0

Discovery Timeline

2026-07-29 - CVE-2026-12436 published to the National Vulnerability Database (NVD)
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-12436

Vulnerability Analysis

The vulnerability resides in GitLab's pipeline schedule input processing logic. When the application handles user-supplied attributes for scheduled pipelines, it fails to validate object attribute assignment. This condition maps to CWE-915, where an application permits modification of attributes that should be immutable or restricted to specific principals. An authenticated user with low privileges can craft requests that alter CI/CD configuration owned by a different user. The scope is marked as changed, meaning the impact extends beyond the attacker's authorization boundary. Confidentiality and integrity are both affected at high levels, while availability is affected at a lower level.

Root Cause

The root cause is improper validation of dynamically-determined object attributes when processing pipeline schedule inputs. GitLab's controller logic accepts attributes from the request without sufficiently constraining which fields the caller may set or which resources the caller may target. This mass-assignment style flaw allows an attacker to bind attributes that reference or modify another user's pipeline schedule configuration.

Attack Vector

The attack requires network access to the GitLab instance and a valid authenticated account with low privileges. Exploitation does not require user interaction. The attacker submits crafted pipeline schedule requests containing attribute values that reference or overwrite CI/CD configuration owned by a different account. Successful exploitation results in unauthorized modification of .gitlab-ci.yml-driven behavior, scheduled job payloads, or associated variables. See the HackerOne Bug Bounty Report and the GitLab Work Item Discussion for additional context.

// No verified public proof-of-concept code is available.
// Refer to the linked GitLab and HackerOne references for technical details.

Detection Methods for CVE-2026-12436

Indicators of Compromise

Unexpected modifications to pipeline schedules, including changes to cron expressions, target branches, or scheduled variables that were not initiated by the schedule owner.
Audit log entries showing PipelineSchedule update actions performed by users who do not own the referenced schedule or project.
New or altered CI/CD variables tied to scheduled pipelines that predate a legitimate change request.
Anomalous job executions triggered by scheduled pipelines outside expected windows.

Detection Strategies

Review GitLab audit events for pipeline_schedule create, update, and take-ownership actions, correlating actor identity against schedule ownership.
Compare current pipeline schedule attributes against a known-good baseline stored in version control or a configuration management database.
Alert on API calls to /api/v4/projects/:id/pipeline_schedules/:schedule_id originating from accounts without a maintainer or owner role for the target project.

Monitoring Recommendations

Forward GitLab production logs, audit events, and Rails application logs to a centralized analytics platform for retention and correlation.
Monitor CI/CD job execution telemetry for schedule-triggered runs that deviate from historical patterns.
Track privileged API usage against pipeline schedule endpoints and alert on ownership boundary crossings.

How to Mitigate CVE-2026-12436

Immediate Actions Required

Upgrade GitLab CE/EE to 19.0.5, 19.1.3, or 19.2.1 depending on your current release branch.
Audit all existing pipeline schedules for unauthorized changes made prior to patching.
Rotate any CI/CD variables or secrets referenced by scheduled pipelines that may have been exposed to tampering.
Review recent CI/CD job output for unexpected commands or artifact modifications introduced through altered schedules.

Patch Information

GitLab addressed CVE-2026-12436 in the 19.2.1 patch release. Consult the GitLab Patch Release Notes for the full list of remediated issues and upgrade paths. Self-managed administrators should follow GitLab's zero-downtime or standard upgrade procedures for their deployment topology.

Workarounds

No official workaround exists; upgrading to a fixed version is the required remediation.
Where immediate patching is not feasible, restrict project membership and reduce the number of low-privilege accounts with access to projects that use pipeline schedules.
Enforce mandatory code review and protected branches so that any tampered CI/CD configuration cannot execute against production targets without approval.

bash

# Example upgrade commands for self-managed GitLab (Omnibus, Linux)
# Debian/Ubuntu
sudo apt-get update
sudo apt-get install gitlab-ee=19.2.1-ee.0

# RHEL/CentOS
sudo yum install gitlab-ee-19.2.1-ee.0

# Verify version after upgrade
sudo gitlab-rake gitlab:env:info | grep 'GitLab information'