GitLab: code execution by authenticated user in CI/CD (CVE-2026-93577)

Code execution by an authenticated user with pipeline access, CVSS 9.9. Fixes in the 23 September 2026 releases.

On 23 September 2026 GitLab fixed CVE-2026-93577, a vulnerability with a CVSS v3.1 score of 9.9 that allows an authenticated user to execute code on the server. The vector is a specially crafted regular expression in CI/CD configuration. The same bulletin also fixes the companion CVE-2026-89078, a double free rated the same.

The requirement is authentication with pipeline access. For this reason the risk is higher where many users can change CI/CD configuration, for example on instances with projects shared across teams.

Update to the fixed release for your branch (19.4.1, 19.3.3 or 19.2.7). In the meantime, reduce pipeline change permissions and review the history of CI/CD configuration changes.

At a glance

What: Code execution on the GitLab server by an authenticated user who can change CI/CD configuration, through a specially crafted regular expression.
Severity: CVSS v3.1 9.9 (critical), according to NVD. The companion CVE-2026-89078 (double free) is rated the same.
Cause: Integer overflow (CWE-190) when compiling a regular expression in CI/CD configuration.
Affected versions: From 19.2 up to but excluding 19.2.7, from 19.3 up to but excluding 19.3.3, from 19.4 up to but excluding 19.4.1, according to NVD.
Fix: GitLab 19.4.1, 19.3.3 and 19.2.7, released on 23 September 2026.
Action: Update. Limit who can change pipeline configuration and review permissions of users with project access.

Sources: NVD, CVE-2026-93577 · GitLab, patch release 19.4.1

← All articles