Vulnerability record/PUBLISHED/Published Sep 23, 2026 23:05:20 UTC

CVE-2026-89078

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due to a double free issue when parsing a specially crafted regular expression in a CI/CD configuration.

Base score9.9/ 10

SeverityCriticalCVSS 3.1

Exploitability / impact

CVSS metric breakdown

Vector-derived attributes

Base severityCritical

Attack vectorNetworkAV

Attack complexityLowAC

Privileges requiredLowPR

User interactionNoneUI

ScopeChangedS

Confidentiality impactHighC

Integrity impactHighI

Availability impactLowA

CVSS vector stringCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.

Record context

CVE Numbering AuthorityGitLab

Last updatedOct 30, 2026 23:19:15 UTC

PublishedSep 23, 2026 23:05:20 UTC

ReservedSep 10, 2026 19:06:37 UTC

Credits

Thanks [joaxcar](https://hackerone.com/joaxcar) for reporting this vulnerability through our HackerOne bug bounty program