CVE-2026-14814: Permissive Regular Expression in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed a user to poison cached responses for raw repository files, causing targeted users' CI/CD pipelines to execute specially crafted content and potentially exposing protected environment variables, due to improper validation of repository references.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 19.2.8 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 19.3.5 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 19.4.2
Event History
Frequently Asked Questions
Which GitLab versions need remediation?
Update GitLab CE/EE to 19.2.8, 19.3.5, or 19.4.2 or later, depending on the release branch. All versions before 19.2.8, versions in the 19.3 branch before 19.3.5, and versions in the 19.4 branch before 19.4.2 are affected.
What level of access does an attacker need?
The attacker needs low privileges as a GitLab user. Exploitation does not require user interaction, but it requires the stated conditions for poisoning cached raw repository-file responses.
Which environments should be prioritized for patching?
Prioritize instances where targeted users' CI/CD pipelines may execute content obtained from raw repository files, especially where protected environment variables are available to those pipelines. Successful exploitation could expose those variables and allow specially crafted content to be executed by the pipeline.