CVE-2026-79708 Overview
CVE-2026-79708 is an authorization vulnerability in GitLab Enterprise Edition (EE) that allows authenticated users with developer permissions to access protected CI/CD variables restricted to higher-privileged roles. The flaw stems from insufficient scope validation when executing policy test pipelines. An attacker with developer-level access to a project within a group can trigger a policy test pipeline and retrieve secrets that should only be accessible to maintainers or owners. The vulnerability is classified under CWE-863: Incorrect Authorization.
Critical Impact
Authenticated developers can exfiltrate protected CI/CD variables, including production credentials, API tokens, and deployment secrets, leading to lateral movement and supply chain compromise.
Affected Products
- GitLab EE versions 19.0 through 19.1.7
- GitLab EE versions 19.2 through 19.2.5
- GitLab EE versions 19.3 through 19.3.1
Discovery Timeline
- 2026-09-16 - CVE-2026-79708 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-79708
Vulnerability Analysis
The vulnerability resides in GitLab EE's policy test pipeline execution logic. Policy test pipelines are designed to validate security and compliance policies before enforcement. During execution, the pipeline runner loads CI/CD variables from the associated project scope. The authorization layer fails to verify whether the invoking user holds sufficient permissions to access variables marked as protected or restricted to higher roles.
Protected CI/CD variables in GitLab are typically reserved for maintainer and owner roles. These variables often contain production database passwords, cloud provider access keys, container registry credentials, and third-party API tokens. When a developer triggers a policy test pipeline through the group interface, the runtime injects these protected values into the pipeline environment without enforcing role-based scope checks.
The issue is compounded by scope changed (S:C in the CVSS vector), meaning the vulnerability crosses trust boundaries. A developer in one project can influence secrets owned by group-level policy configurations.
Root Cause
The root cause is insufficient scope validation within the policy test pipeline execution path. The authorization check verifies that the user can trigger the pipeline but does not re-validate access rights against each variable's minimum role requirement before injection into the runner environment.
Attack Vector
Exploitation requires an authenticated GitLab account with developer permissions on a project within a group that has security or compliance policies configured. The attacker navigates to the policy test pipeline interface, executes a test pipeline, and captures the injected environment variables through pipeline logs, artifacts, or a malicious script executed by the runner. No user interaction from higher-privileged users is required.
Exploitation details are described in the HackerOne Report #3873243 and tracked in GitLab Work Item #622477.
Detection Methods for CVE-2026-79708
Indicators of Compromise
- Unexpected execution of policy test pipelines by users holding only developer role permissions.
- Pipeline job logs or artifacts containing references to variables normally scoped to maintainer or owner roles.
- Outbound network connections from GitLab runners to attacker-controlled infrastructure following policy test pipeline execution.
- Anomalous access patterns to secrets referenced in CI/CD variable configurations shortly after pipeline execution events.
Detection Strategies
- Audit GitLab audit events for policy_test_pipeline executions correlated with developer-role user identifiers.
- Review pipeline job artifacts and logs for exposure of variable values that resemble secrets (tokens, keys, credentials).
- Cross-reference pipeline execution timestamps with subsequent authentication events using the same credentials from unexpected source IPs.
Monitoring Recommendations
- Enable GitLab audit event streaming to a central SIEM and alert on policy test pipeline triggers by non-maintainer accounts.
- Monitor runner egress traffic for unexpected destinations, especially during test pipeline execution windows.
- Rotate and monitor usage of CI/CD variables classified as protected, particularly on GitLab EE instances running affected versions.
How to Mitigate CVE-2026-79708
Immediate Actions Required
- Upgrade GitLab EE to version 19.1.8, 19.2.6, or 19.3.2 depending on your current release track.
- Rotate all protected CI/CD variables that may have been accessible through affected GitLab EE instances since deployment of the vulnerable versions.
- Audit historical policy test pipeline executions for developer-role users and investigate any anomalous activity.
Patch Information
GitLab released fixes in versions 19.1.8, 19.2.6, and 19.3.2. Full details are available in the GitLab Patch Release Notes. Administrators should apply the appropriate patch for their release branch and validate the upgrade with the standard GitLab health check endpoints.
Workarounds
- Restrict developer role assignments on groups that use security or compliance policy configurations until patching is complete.
- Temporarily disable policy test pipeline features on affected group projects where feasible.
- Move highly sensitive credentials from GitLab CI/CD variables into an external secrets manager referenced at runtime with per-role access controls.
# Verify installed GitLab version and confirm patched release
sudo gitlab-rake gitlab:env:info | grep -i version
# Example upgrade path for Omnibus GitLab EE on Debian/Ubuntu
sudo apt-get update
sudo apt-get install gitlab-ee=19.3.2-ee.0
sudo gitlab-ctl reconfigure
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
