CVE-2026-13113: GitLab EE Race Condition Vulnerability

CVE-2026-13113 Overview

CVE-2026-13113 is a race condition vulnerability in GitLab Enterprise Edition (EE) affecting the approval rule processing logic for protected branches. Under specific conditions, an authenticated user can merge code into a protected branch without obtaining the required approvals. The flaw is classified under [CWE-367] Time-of-Check Time-of-Use (TOCTOU) and impacts GitLab EE versions from 17.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1. GitLab has released patched versions that remediate the issue.

Critical Impact
An authenticated user can bypass merge request approval requirements and push unreviewed code into protected branches, undermining code review and change control policies.

Affected Products

GitLab EE versions 17.0 up to (excluding) 19.0.5
GitLab EE versions 19.1 up to (excluding) 19.1.3
GitLab EE versions 19.2 up to (excluding) 19.2.1

Discovery Timeline

2026-07-29 - CVE-2026-13113 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-13113

Vulnerability Analysis

The vulnerability resides in GitLab EE's approval rule processing subsystem, which validates whether a merge request meets the configured approval policies before allowing a merge into a protected branch. Because the check and the merge action are not performed atomically, concurrent requests can interleave in a way that permits the merge to proceed while the approval state is inconsistent.

An authenticated user with permission to open and merge requests can trigger the race window. The result is code entering a protected branch without the number or identity of approvers mandated by branch protection policy. This bypass affects the integrity of the source code repository but does not directly disclose confidential data or degrade service availability.

Root Cause

The root cause is a Time-of-Check Time-of-Use (TOCTOU) flaw [CWE-367]. Approval status is evaluated at one point in the merge workflow, then acted upon at a later point. Between those two operations, the underlying approval state can change or be evaluated inconsistently, allowing a merge to succeed when it should be blocked. GitLab documents the fix in GitLab Patch Release 19.2.1 and internal tracking issue GitLab Work Item #597838.

Attack Vector

Exploitation requires network access to a GitLab instance and a valid authenticated account with the ability to submit and merge merge requests. The attacker triggers concurrent merge or approval operations timed to exploit the non-atomic approval check. No user interaction from other maintainers is required, and the attack executes remotely against the web application.

No verified proof-of-concept code is publicly available. Refer to the vendor advisory for technical details on the fix.

Detection Methods for CVE-2026-13113

Indicators of Compromise

Merge commits landing on protected branches with fewer approvers than the configured approval rule requires.
Merge request audit events showing a merge action shortly after or concurrent with approval state changes.
Merges completed by users listed in the merge request's exclusion set for self-approval.
Unexpected pipeline runs on protected branches originating from merge requests that lack a full approval trail.

Detection Strategies

Query the GitLab audit log and API for merge events on protected branches, and reconcile approver counts against branch protection policy.
Flag merge requests where the time delta between the final approval event and the merge event is unusually short or negative in ordering.
Compare merge_requests.merged_at timestamps against approval_rules state history to identify inconsistencies.

Monitoring Recommendations

Forward GitLab audit events and webhook data to a centralized logging platform and alert on protected-branch merges that violate approval policy.
Enable GitLab's compliance dashboard and review merge request approvals for protected branches on a recurring cadence.
Monitor for repeated, rapid approval and merge API calls from the same authenticated session, which may indicate race exploitation attempts.

How to Mitigate CVE-2026-13113

Immediate Actions Required

Upgrade GitLab EE to version 19.0.5, 19.1.3, or 19.2.1, whichever is appropriate for your release track.
Audit protected branches for merges that occurred before patching and validate approval trails against policy.
Rotate or review credentials of any accounts that produced anomalous merges on protected branches.

Patch Information

GitLab addressed the issue in EE releases 19.0.5, 19.1.3, and 19.2.1. Details are published in the GitLab Patch Release 19.2.1 notes, with internal tracking in GitLab Work Item #597838. Self-managed administrators should apply the patch on the corresponding minor release track. GitLab.com is maintained by the vendor.

Workarounds

No official workaround replaces patching; upgrade to a fixed version as the primary remediation.
As a compensating control, restrict merge permissions on protected branches to a minimal group of maintainers until the upgrade is applied.
Enable required status checks and merge trains where feasible to add serialization around merge operations.
Increase audit review frequency for protected-branch merges during the remediation window.

bash

# Verify the installed GitLab version and confirm it is patched
sudo gitlab-rake gitlab:env:info | grep -i "GitLab information" -A 5

# Example: tighten protected branch settings via API until patched
curl --request PATCH --header "PRIVATE-TOKEN: <token>" \
  "https://gitlab.example.com/api/v4/projects/<id>/protected_branches/main" \
  --data "allowed_to_merge[][access_level]=40"