CVE-2026-15387: GitLab EE Privilege Escalation Vulnerability

CVE-2026-15387 Overview

CVE-2026-15387 affects GitLab Enterprise Edition (EE) across multiple release branches. An authenticated user with developer-role permissions can influence the execution environment of Pipeline Execution Policy enforcement jobs. The flaw stems from improper handling of job dependencies, mapped to [CWE-349: Acceptance of Extraneous Untrusted Data With Trusted Data].

GitLab remediated the issue in versions 19.1.7, 19.2.5, and 19.3.1. Exploitation requires an authenticated account with developer privileges and yields limited integrity impact against pipeline security controls.

Critical Impact
A developer-role user can manipulate Pipeline Execution Policy enforcement jobs, weakening the integrity of policy-driven CI/CD security controls.

Affected Products

GitLab EE versions 19.1 before 19.1.7
GitLab EE versions 19.2 before 19.2.5
GitLab EE versions 19.3 before 19.3.1

Discovery Timeline

2026-08-26 - CVE-2026-15387 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-15387

Vulnerability Analysis

GitLab Pipeline Execution Policies enforce mandatory CI/CD job steps across projects. These policies rely on isolated enforcement jobs whose execution environment must remain outside developer control. CVE-2026-15387 breaks that isolation.

A developer-role user can influence the runtime context of enforcement jobs by manipulating job dependencies. The issue allows untrusted, developer-controlled data to be accepted alongside trusted policy-defined data. Attackers can alter inputs consumed by enforcement steps, degrading the assurance those policies provide.

The vulnerability requires authentication and a valid developer role on a target project. It does not grant code execution against GitLab itself. Instead, it undermines policy enforcement, which can cascade into downstream supply chain and compliance gaps.

Root Cause

The root cause is improper handling of job dependencies in the Pipeline Execution Policy subsystem. GitLab did not sufficiently segregate developer-supplied dependency metadata from policy-controlled enforcement job configuration. As a result, developer inputs propagate into the enforcement job environment where they should be treated as untrusted.

Attack Vector

The attack vector is network-based and authenticated. A user with developer permissions crafts pipeline configuration or job dependencies that intersect with the Pipeline Execution Policy enforcement pipeline. When the enforcement job runs, developer-influenced context reaches the policy environment. See the GitLab Patch Release Notice, GitLab Work Item #605632, and HackerOne Report #3754358 for technical details.

No public exploit code is available for CVE-2026-15387 at this time.

Detection Methods for CVE-2026-15387

Indicators of Compromise

Pipeline Execution Policy enforcement jobs referencing artifacts or variables sourced from developer-controlled jobs.
Unexpected needs: or dependencies: entries in enforcement job runtime logs.
Policy enforcement job outputs deviating from the policy-defined baseline.

Detection Strategies

Audit .gitlab-ci.yml and Pipeline Execution Policy definitions for cross-references between developer jobs and enforcement jobs.
Compare enforcement job execution logs against expected policy baselines to identify tampered environments.
Review GitLab audit events for pipeline configuration changes made by developer-role accounts on projects governed by security policies.

Monitoring Recommendations

Forward GitLab audit and CI/CD job logs to a centralized analytics platform for correlation.
Alert on modifications to Pipeline Execution Policy scopes and on enforcement jobs consuming unexpected artifacts.
Track developer-role activity on projects assigned high-sensitivity security policies.

How to Mitigate CVE-2026-15387

Immediate Actions Required

Upgrade GitLab EE to 19.1.7, 19.2.5, or 19.3.1 depending on your deployed branch.
Review Pipeline Execution Policy definitions for enforcement jobs that consumed developer-supplied inputs prior to patching.
Rotate any secrets or tokens that may have been exposed to compromised enforcement job environments.

Patch Information

GitLab released fixes in versions 19.1.7, 19.2.5, and 19.3.1. Administrators should apply the appropriate patch for their branch. Details are available in the GitLab Patch Release Notice.

Workarounds

Restrict developer-role assignments on projects governed by Pipeline Execution Policies until patched.
Minimize cross-project pipeline dependencies where enforcement jobs run alongside developer-controlled jobs.
Enforce mandatory code review and protected branches for .gitlab-ci.yml changes on policy-scoped projects.

bash

# Verify installed GitLab version
gitlab-rake gitlab:env:info | grep -i "GitLab information" -A 5

# Debian/Ubuntu upgrade example
sudo apt-get update && sudo apt-get install gitlab-ee=19.3.1-ee.0

# RHEL/CentOS upgrade example
sudo yum install gitlab-ee-19.3.1-ee.0