Skip to main content
Apexward Pulse

GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have…

CVE-2026-89078

What this means

This is rated critical severity (9.9 out of 10). There is no confirmed exploitation of it yet. Ask IT whether Gitlab Gitlab is in your estate, and treat that as the priority.

Full vendor description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due to a double free issue when parsing a specially crafted regular expression in a CI/CD configuration.

Scoring and exploitation

9.9/ 10
CVSS 3.1 base scoreCritical

Exploitable over the network with a low-privilege account, and no one has to click or open anything. High impact on confidentiality and integrity; low on availability, and it can reach beyond the vulnerable system.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Exploitability

Longer bar: easier to attack

Attack vectorNetworkAV:N
Attack complexityLowAC:L
Privileges requiredLowPR:L
User interactionNoneUI:N
ScopeChangedS:C

Impact

Longer bar: more harm

ConfidentialityHighC:H
IntegrityHighI:H
AvailabilityLowA:L
Not reported
Exploited in the wild
Not confirmed in the
Not reported

Weaknesses

CWE-415

Affected products ()

  • Gitlab Gitlab
Show the raw CPE strings (4)
  • cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
  • cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
  • cpe:2.3:a:gitlab:gitlab:19.4.0:*:*:*:community:*:*:*
  • cpe:2.3:a:gitlab:gitlab:19.4.0:*:*:*:enterprise:*:*:*

References

4 links from the CVE record, grouped by site; the vendor's advisory comes first.

Related feed events