CVE-2026-13210: Incorrect Authorization in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user to access CI/CD variables outside their intended environment scope due to improper input validation in the environment scope pattern matcher.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 19.1.8 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 19.2.6 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 19.3.2
Event History
Frequently Asked Questions
Which deployments are affected and which releases contain the fix?
GitLab CE and EE are affected from version 15.7 up to, but not including, 19.1.8; version 19.2 up to, but not including, 19.2.6; and version 19.3 up to, but not including, 19.3.2. Upgrade to 19.1.8, 19.2.6, 19.3.2, or a later release in the applicable release line.
What access does an attacker need?
An attacker needs an authenticated GitLab user account. The issue may allow that user, under certain conditions, to access CI/CD variables outside the environment scope for which they were intended.
What data is at risk?
The disclosed impact is exposure of CI/CD variables outside their intended environment scope. The provided information does not identify particular variable types or provide a workaround for systems that cannot be upgraded immediately.