CVE-2026-15077: Improper Neutralization of Input Used for LLM Prompting in GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.3 and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to access information from unauthorized projects due to improper neutralization of untrusted content processed by the AI-assisted code review functionality.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 19.1.3 - Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 19.2.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-15077?
The severity of CVE-2026-15077 is medium with a CVSS score of 4.3.
How do I fix CVE-2026-15077?
To fix CVE-2026-15077, you should update GitLab EE to version 19.1.3 or 19.2.1 or later.
What impacts does CVE-2026-15077 have on GitLab?
CVE-2026-15077 could allow authenticated users to access unauthorized project information due to improper neutralization of untrusted content.
Which GitLab versions are affected by CVE-2026-15077?
CVE-2026-15077 affects all GitLab EE versions from 19.1 before 19.1.3 and from 19.2 before 19.2.1.
Is CVE-2026-15077 an authenticated vulnerability?
Yes, CVE-2026-15077 is an authenticated vulnerability requiring user authentication to exploit.