Two other flaws target pipeline security. CVE-2026-16301 (CVSS 8.5) could have allowed users with the Developer role to execute CI/CD pipelines on protected branches without authorization. CVE-2026-14814 (CVSS 8.2) potentially enabled attackers to poison cached responses for raw repository files, potentially causing targeted pipelines to execute malicious content and access protected environment variables.
The remaining issues affect scheduled pipeline execution and GitLab Duo. CVE-2026-81839 (CVSS 7.7) could have allowed authenticated users to run arbitrary pipelines in a transferred project with the new group’s privileges. Another, CVE-2026-96893 (CVSS 7.3), could have allowed an authenticated user to inject crafted content into AI agent instructions, potentially causing unintended command execution attributed to other users.
GitLab said it plans to make vulnerability issue details public 90 days after the release in which they were patched. Administrators should therefore prioritize the applicable security updates rather than wait for further technical disclosure. The release also fixes several low-to-medium severity vulnerabilities affecting GitLab Pages, Kubernetes proxying, GraphQL APIs, merge requests, custom roles, the package registry, and repository and project import functions.
