GitLab patches a max-severity regex flaw alongside five high-severity bugs
GitLab just fixed a max-severity vulnerability that could allow unauthenticated attackers to execute arbitrary code on its servers. The company released a fix on Monday, alongside patches for five other high-severity flaws affecting its source code management and continuous…
Riportata anche da Security Affairs
Two other flaws target pipeline security. CVE-2026-16301 (CVSS 8.5) could have allowed users with the Developer role to execute CI/CD pipelines on protected branches without authorization. CVE-2026-14814 (CVSS 8.2) potentially enabled attackers to poison cached responses for raw repository files, potentially causing targeted pipelines to execute malicious content and access protected environment variables.
The remaining issues affect scheduled pipeline execution and GitLab Duo. CVE-2026-81839 (CVSS 7.7) could have allowed authenticated users to run arbitrary pipelines in a transferred project…
