CVE-2026-3035 Overview
CVE-2026-3035 is an improper authorization vulnerability in GitLab Enterprise Edition (EE). An authenticated user holding project Maintainer permissions can access the terminal of a protected environment they are not authorized to use. The flaw stems from missing authorization checks on the terminal access path and is tracked under CWE-288: Authentication Bypass Using an Alternate Path or Channel. GitLab has released fixed versions across the affected release branches.
Critical Impact
A project Maintainer can reach terminals of protected environments outside their authorization scope, exposing running workloads and secrets accessible from those sessions.
Affected Products
- GitLab EE all versions from 11.3 before 19.1.7
- GitLab EE 19.2 before 19.2.5
- GitLab EE 19.3 before 19.3.1
Discovery Timeline
- 2026-08-26 - CVE-2026-3035 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-3035
Vulnerability Analysis
The issue affects the protected environment terminal feature in GitLab EE. Protected environments restrict which users and groups can perform deployments and interact with the environment, including terminal access to running deployments. The authorization enforcement on this terminal channel is incomplete. A user with project Maintainer role can open a terminal session for a protected environment even when the environment's access rules do not grant that user deploy or operate permissions.
Because project Maintainer is a role commonly delegated to release engineers and senior developers, this reduces the effective separation of duties that protected environments are designed to provide. Terminal access typically exposes the runtime context of the deployment, including environment variables, mounted secrets, and the ability to execute arbitrary commands in the workload.
Root Cause
The root cause is an authorization check that validates the caller's project role but fails to validate membership in the protected environment's deploy access list. The terminal endpoint trusts the higher-level project role check and does not enforce the environment-scoped policy, resulting in a broken access control condition classified as CWE-288.
Attack Vector
Exploitation requires network access to the GitLab instance and authenticated credentials with project Maintainer permissions on the target project. The attacker navigates to the environment or triggers the terminal channel for a protected environment they are not listed on, and the server grants the session. No user interaction from another user is required. See the GitLab Work Item Details and the HackerOne Security Report #3529751 for tracking references.
No public proof-of-concept exploit code is available. The vulnerability is described in prose only per the referenced advisories.
Detection Methods for CVE-2026-3035
Indicators of Compromise
- Terminal session initiation events on protected environments by users who are not on the environment's deploy access list.
- Web terminal WebSocket connections (/terminal.ws or /environments/*/terminal) originating from Maintainer accounts outside the approved deployer group.
- Unexpected shell activity inside deployment pods or runners tied to protected environments during off-hours or from unusual source IPs.
Detection Strategies
- Correlate GitLab audit events for environment_terminal or web_terminal_session actions against the protected environment's authorized user and group list.
- Alert on any terminal access where actor_role = Maintainer and actor_id is not a member of the environment's deploy access rules.
- Review Kubernetes API audit logs for pods/exec calls initiated by GitLab service accounts and pivot back to the initiating GitLab user.
Monitoring Recommendations
- Ingest GitLab audit event streams and Kubernetes audit logs into a centralized SIEM or data lake and retain them for post-incident review.
- Baseline normal terminal usage per protected environment and alert on new principals accessing those sessions.
- Track command execution inside production and staging pods for signs of secret extraction or lateral movement following an unauthorized terminal session.
How to Mitigate CVE-2026-3035
Immediate Actions Required
- Upgrade GitLab EE to 19.1.7, 19.2.5, or 19.3.1, matching the deployed release branch.
- Rotate secrets, tokens, and deployment credentials reachable from any protected environment terminal, especially in production.
- Review audit logs for terminal sessions in protected environments since the affected versions were deployed.
Patch Information
GitLab has released patched versions 19.1.7, 19.2.5, and 19.3.1. Refer to the GitLab Patch Release Notice for upgrade guidance and the full list of security fixes in this release.
Workarounds
- Restrict the Maintainer role to a minimal set of trusted users until the upgrade is applied.
- Temporarily disable web terminal access on protected environments where the feature is not required for operations.
- Enforce strong environment-level deploy access rules and audit them for stale group memberships.
# Verify installed GitLab version and confirm the upgrade
gitlab-rake gitlab:env:info | grep -i "GitLab information" -A 5
sudo gitlab-ctl status
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
