CVE-2026-15423: GitLab Auth Bypass Vulnerability

CVE-2026-15423 Overview

CVE-2026-15423 is an authorization flaw in GitLab Community Edition (CE) and Enterprise Edition (EE) that allows authenticated users with developer-role permissions to execute CI/CD pipelines on protected branches. The vulnerability stems from improper authorization in pipeline reference validation, bypassing the requirement for push permissions on the protected branch. GitLab has released patches across multiple release trains to address the issue.

Critical Impact
An authenticated developer-role user can execute CI/CD pipelines against protected branches without holding the required push permissions, undermining branch protection controls and enabling execution of pipeline logic in a privileged context.

Affected Products

GitLab CE/EE 19.0 prior to 19.0.6
GitLab CE/EE 19.1 prior to 19.1.4
GitLab CE/EE 19.2 prior to 19.2.2

Discovery Timeline

2026-08-12 - CVE-2026-15423 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-15423

Vulnerability Analysis

The flaw resides in GitLab's pipeline reference validation logic. When a user triggers a CI/CD pipeline targeting a protected branch, GitLab must verify that the requester holds push permissions on that branch. In affected versions, this authorization check is not consistently enforced during pipeline reference validation.

A user granted the developer role can therefore initiate pipelines against a protected branch even when the branch protection rules restrict pushes to maintainers or owners. Because pipelines commonly run with access to CI/CD variables, deployment credentials, and job tokens, the bypass can be leveraged to reach resources that should remain outside the developer's privilege boundary.

The issue is classified under CWE-863: Incorrect Authorization, reflecting a gap between the intended access policy on protected branches and the checks executed during pipeline dispatch.

Root Cause

Protected branches in GitLab enforce a separation between users who can read a repository, users who can push code, and users who can run privileged pipelines against protected refs. The vulnerable code path evaluates the pipeline reference without cross-checking the caller's push entitlement on that reference. This inconsistency between the branch protection model and the pipeline authorization path is the root cause.

Attack Vector

Exploitation requires an authenticated account with at least developer-level access to a GitLab project. The attacker submits a pipeline request that targets a protected branch through the API or web UI. Because push permission is not enforced, the pipeline executes with the CI/CD context of the protected branch, exposing protected variables and deployment credentials scoped to that ref.

See the HackerOne Report #3832069 and the GitLab Work Item Details for additional technical context.

Detection Methods for CVE-2026-15423

Indicators of Compromise

Pipeline execution records on protected branches where the triggering user does not hold push permission on that branch.
Unexpected use of protected CI/CD variables or deployment tokens by pipelines initiated by developer-role accounts.
Job logs showing access to protected environments from pipelines that were not created by maintainers or owners.

Detection Strategies

Query the GitLab audit event stream and pipeline API for pipelines targeting protected refs, then correlate the triggering user against the project's branch protection rules.
Review CI/CD job tokens and deployment activity for actions performed on protected environments by users lacking maintainer role.
Alert on any pipeline created against a protected branch where the user's role is developer or lower.

Monitoring Recommendations

Forward GitLab audit logs and pipeline events into a centralized SIEM or data lake for retention and correlation.
Baseline normal pipeline creators per protected branch and alert on deviations.
Monitor for changes to protected branch settings or CI/CD variables that occur immediately after a suspicious pipeline run.

How to Mitigate CVE-2026-15423

Immediate Actions Required

Upgrade GitLab CE/EE instances to 19.0.6, 19.1.4, or 19.2.2 as applicable to the deployed release train.
Audit recent pipeline activity on protected branches for executions initiated by developer-role users.
Rotate any CI/CD variables, deployment tokens, or secrets that may have been exposed to unauthorized pipeline runs.

Patch Information

GitLab has released fixed versions 19.0.6, 19.1.4, and 19.2.2 that correct the pipeline reference authorization logic. Full details are available in the GitLab Patch Release Notes. Self-managed GitLab operators should apply the patch matching their current release train; GitLab.com has already been updated.

Workarounds

Restrict developer-role assignments on projects containing sensitive protected branches until patches are applied.
Remove or scope protected CI/CD variables so they are not accessible to pipelines triggered outside of maintainer-controlled workflows.
Require merge request approvals from maintainers before merges to protected branches to reduce indirect pipeline abuse paths.

bash

# Verify installed GitLab version on a self-managed instance
sudo gitlab-rake gitlab:env:info | grep -i "GitLab information" -A 5

# Example upgrade path on Omnibus GitLab (Debian/Ubuntu)
sudo apt-get update
sudo apt-get install gitlab-ee=19.2.2-ee.0
sudo gitlab-ctl reconfigure
sudo gitlab-ctl restart