Description

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with developer-role permissions could have influenced the execution environment of Pipeline Execution Policy enforcement jobs, due to improper handling of job dependencies.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-26T14:17:07.540Z",
  "pubdate": "2026-08-26T14:17:07.540Z",
  "executiveSummary": "This vulnerability involves an improper handling of job dependencies within GitLab EE, which permits an authenticated user with Developer-level permissions to manipulate the execution environment of Pipeline Execution Policy enforcement jobs.\nThe issue is classified as a privilege escalation and environment manipulation vulnerability, affecting specific releases of GitLab EE.\nBy influencing the environment in which policy enforcement jobs run, an attacker can bypass security controls or exert unauthorized control over the CI/CD pipeline integrity.\nThe attack requires an authenticated user with Developer role access, which is a standard internal permission level for project contributors.\nThe impact is significant, as Pipeline Execution Policies are designed to mandate security and compliance standards; compromising these jobs undermines the entire CI/CD security posture.\nOrganizations using GitLab EE versions 19.1.x, 19.2.x, or 19.3.x are at risk and must upgrade to the patched versions immediately to prevent malicious interference with automated security gates.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper processing and isolation of job dependencies within the GitLab CI/CD engine, specifically concerning Pipeline Execution Policies (PEP). When GitLab evaluates a pipeline, it may dynamically include enforcement jobs to ensure compliance with organization-wide security policies. Due to a defect in how these jobs resolve dependencies, an authenticated user with Developer permissions can inject or modify environment variables or configuration states that influence the context of the enforcement job.\nThe attack flow begins with the malicious actor crafting a pipeline configuration that interacts with the pipeline dependency graph. By leveraging the way GitLab links job artifacts or environment parameters, the attacker forces the enforcement job to inherit or execute within a compromised context. Because the enforcement job runs with elevated or system-level policies, the attacker can effectively 'poison' the environment, potentially altering the outcome of security scans, disabling mandatory compliance checks, or exfiltrating sensitive credentials assigned to the enforcement runner.\nAffected GitLab EE versions include 19.1 (before 19.1.7), 19.2 (before 19.2.5), and 19.3 (before 19.3.1). The exploitation is strictly internal to the GitLab instance, requiring no external network exposure, as it relies on the logical misconfiguration of the pipeline execution sequence. Once the enforcement job is subverted, the post-exploitation impact includes the bypass of critical security gates, unauthorized modification of artifact integrity, and the potential to execute arbitrary code within the scope of the CI runner's environment if the injected parameters are parsed by the enforcement script.\nThis vulnerability highlights a failure in trust boundary enforcement between user-defined pipeline jobs and system-enforced security policies. The vulnerability allows the user's defined dependencies to bleed into the protected space of the policy enforcement mechanism, violating the principle of isolation. Attackers can exploit this by ensuring their malicious job dependency is prioritized or resolved in a manner that shadows the intended configuration of the policy enforcement job, effectively redirecting the execution path."
}