CVE-2026-15077 Overview
CVE-2026-15077 is an information disclosure vulnerability in GitLab Enterprise Edition (EE). The flaw stems from improper neutralization of untrusted content processed by the AI-assisted code review functionality. Under specific conditions, an authenticated user can access information from projects they are not authorized to view. GitLab has addressed the issue in patched releases 19.1.3 and 19.2.1.
Critical Impact
Authenticated attackers can retrieve confidential data from unauthorized GitLab projects by manipulating content processed by AI-assisted code review, leading to cross-project information disclosure.
Affected Products
- GitLab EE versions 19.1 before 19.1.3
- GitLab EE versions 19.2 before 19.2.1
- Deployments with AI-assisted code review functionality enabled
Discovery Timeline
- 2026-07-29 - CVE-2026-15077 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-15077
Vulnerability Analysis
The vulnerability resides in GitLab EE's AI-assisted code review feature. The feature processes user-supplied content and feeds it into an AI backend that has broader read access than the requesting user. Because untrusted content is not properly neutralized before processing, an authenticated attacker can craft input that induces the AI component to return data belonging to projects outside the attacker's authorization scope.
The result is a confidentiality breach limited to information the AI subsystem can retrieve. Integrity and availability are not affected, and no privileged role is required beyond an authenticated GitLab account.
Root Cause
The root cause is improper neutralization of untrusted content passed to the AI-assisted code review pipeline. The feature trusts input embedded in code, comments, or review artifacts. Attackers can embed indirect prompt-injection style payloads that redirect the AI component to read and disclose data from other projects. Authorization checks are enforced at the user interface layer but not consistently at the AI processing boundary.
Attack Vector
Exploitation requires network access to a GitLab EE instance and a valid authenticated account. An attacker submits malicious content, such as crafted code, commit messages, or review comments, to a project they control. When AI-assisted code review processes that content, injected instructions cause the AI backend to reference or reveal content from projects the attacker cannot access directly. The disclosed information is then returned to the attacker through the review interface.
The vulnerability manifests within the AI processing boundary of the code review workflow. See the GitLab Patch Release 19.2.1 and GitLab Work Item #601482 for technical details.
Detection Methods for CVE-2026-15077
Indicators of Compromise
- AI-assisted code review responses that reference project names, file paths, or identifiers outside the requesting user's authorized project scope.
- Code review submissions containing prompt-injection style patterns, such as embedded natural-language directives instructing the AI to disclose or list other repositories.
- Unusual audit log entries showing AI feature invocations by users who then access or export data shortly afterward.
Detection Strategies
- Review GitLab audit logs for AI-assisted code review activity correlated with accounts that have limited project membership.
- Inspect code review artifacts and merge request diffs for suspicious embedded instructions targeting AI processing.
- Alert on AI response payloads that contain identifiers, secrets, or file paths not associated with the source project.
Monitoring Recommendations
- Enable verbose logging for AI-assisted features and forward logs to a centralized SIEM for correlation.
- Monitor authenticated user behavior for anomalous access patterns following AI feature usage.
- Track version inventory of GitLab EE deployments to confirm patched builds are running across all instances.
How to Mitigate CVE-2026-15077
Immediate Actions Required
- Upgrade GitLab EE instances on the 19.1 branch to 19.1.3 or later.
- Upgrade GitLab EE instances on the 19.2 branch to 19.2.1 or later.
- Audit recent AI-assisted code review activity for signs of cross-project data access.
- Review project membership and reduce unnecessary AI feature access for low-trust accounts.
Patch Information
GitLab has released fixed versions 19.1.3 and 19.2.1 that remediate the improper neutralization issue in AI-assisted code review. Refer to the GitLab Patch Release 19.2.1 announcement for upgrade instructions and full release notes.
Workarounds
- Disable the AI-assisted code review feature at the group or instance level until patches are applied.
- Restrict AI feature availability to trusted user groups through GitLab's feature flag and permission controls.
- Enforce stricter content review policies on merge requests originating from low-privilege or external contributors.
# Verify installed GitLab version and confirm patched build
sudo gitlab-rake gitlab:env:info | grep -i "GitLab information" -A 5
# Example: disable AI-assisted features via Rails console until patched
sudo gitlab-rails console
# Feature.disable(:ai_review_merge_request)
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
