CVE-2026-16301: GitLab Auth Bypass Vulnerability

CVE-2026-16301 Overview

CVE-2026-16301 is an authorization flaw in GitLab Community Edition (CE) and Enterprise Edition (EE). The vulnerability allows an authenticated user with the Developer role to execute CI/CD pipelines on protected branches without authorization. The root cause is an improper authorization check in the downstream pipeline creation service [CWE-863]. Affected versions include GitLab CE/EE from 18.7 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. GitLab addressed the issue in patch release 19.4.2.

Critical Impact
Authenticated Developer-role users can bypass protected branch controls to execute downstream CI/CD pipelines, enabling unauthorized code execution in build environments and tampering with trusted branches.

Affected Products

GitLab Community Edition (CE) versions 18.7 through 19.2.7
GitLab Enterprise Edition (EE) versions 19.3 through 19.3.4
GitLab CE/EE versions 19.4 through 19.4.1

Discovery Timeline

2026-10-13 - CVE-2026-16301 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-16301

Vulnerability Analysis

The flaw resides in GitLab's downstream pipeline creation service, the component responsible for triggering child or multi-project pipelines from a parent pipeline. Downstream pipelines inherit execution context from the triggering job, including branch targeting and job definitions.

Under specific conditions, the service failed to verify that the invoking user held permissions to run pipelines against protected branches. Protected branches in GitLab normally restrict pipeline execution to users with Maintainer or higher roles, enforcing separation of duties between developers and release managers.

Because the authorization check was absent or incomplete, a user holding only the Developer role could initiate downstream pipelines targeting protected branches. This undermines the branch protection model that organizations rely on for release gating, deployment approval, and compliance.

Root Cause

The vulnerability maps to CWE-863: Incorrect Authorization. The downstream pipeline creation service did not re-validate the triggering user's authorization against the target branch's protection rules. The service trusted the parent pipeline context rather than enforcing an independent permission check at the point of downstream pipeline creation.

Attack Vector

An authenticated attacker with Developer-level access to a GitLab project configures a parent pipeline that triggers a downstream pipeline against a protected branch. The downstream service accepts the request without validating that the user has rights to run jobs on that branch. The resulting pipeline executes with the CI/CD variables, runners, and secrets associated with the protected branch. This can expose deployment credentials, enable injection of malicious artifacts into release workflows, or allow tampering with production build outputs. No code example is published; see the HackerOne Report #3853866 and GitLab Work Item #606501 for technical details.

Detection Methods for CVE-2026-16301

Indicators of Compromise

Pipeline execution records showing downstream pipelines on protected branches triggered by users with only Developer role.
Unexpected access to protected CI/CD variables or deployment credentials from jobs initiated by non-privileged users.
.gitlab-ci.yml modifications introducing trigger: keywords that target protected branches from unprotected parent pipelines.

Detection Strategies

Audit the GitLab ci_pipelines and ci_builds tables for downstream pipelines whose user_id lacks Maintainer or higher privileges on the target protected branch.
Correlate GitLab audit events for pipeline creation with the triggering user's project role at the time of execution.
Review runner logs for jobs that accessed protected CI/CD variables while being invoked by Developer-role users.

Monitoring Recommendations

Enable GitLab audit event streaming to a centralized SIEM and alert on pipeline creation events referencing protected branches.
Monitor API calls to /api/v4/projects/:id/trigger/pipeline and parent-child pipeline creation endpoints for anomalous invocation patterns.
Track changes to protected branch configuration and CI/CD variable scopes to detect post-exploitation persistence attempts.

How to Mitigate CVE-2026-16301

Immediate Actions Required

Upgrade GitLab CE/EE to version 19.4.2, 19.3.5, or 19.2.8 as applicable to your release train.
Rotate CI/CD variables, deployment tokens, and runner registration tokens scoped to protected branches if unauthorized pipeline execution is suspected.
Review pipeline history across all projects for downstream executions by Developer-role users targeting protected branches since version 18.7.

Patch Information

GitLab released the fix in the GitLab 19.4.2 patch release. Self-managed installations should upgrade to one of the patched versions: 19.4.2, 19.3.5, or 19.2.8. GitLab.com SaaS instances are already running the patched version.

Workarounds

Restrict use of parent-child and multi-project pipeline triggers in projects where protected branches hold sensitive deployment logic.
Temporarily elevate the minimum role required for pipeline execution on protected branches to Maintainer until the patch is applied.
Remove or scope down CI/CD variables marked as protected if they cannot be rotated immediately after patching.

bash

# Verify installed GitLab version and upgrade on an Omnibus package install
sudo gitlab-rake gitlab:env:info | grep "GitLab information" -A 10

# Debian/Ubuntu upgrade example
sudo apt-get update
sudo apt-get install gitlab-ee=19.4.2-ee.0

# RHEL/CentOS upgrade example
sudo yum install gitlab-ee-19.4.2-ee.0.el8

# Reconfigure and restart services after upgrade
sudo gitlab-ctl reconfigure
sudo gitlab-ctl restart