Database/Control plane, storage & DevOps
GitLab EE: custom role with compliance framework admin can run crafted pipelines across group projects
Impact
A user holding a custom role with compliance framework administration permissions can configure and execute a crafted compliance pipeline against projects across the group, which they were not authorized to run jobs in. Where GitLab drives a fleet's CI, that means attacker-chosen jobs land on shared runners - including GPU runners with accelerator access, mounted datasets and registry or cloud credentials in the job environment. The practical risk is unauthorized code execution in other teams' CI context rather than direct compromise of GitLab itself; GitLab rates integrity impact as low and claims no confidentiality impact. Operators who treat the compliance-framework permission as a read-only audit role should re-check who holds it.
Who can reach it
An authenticated GitLab user who has been granted a custom role carrying compliance framework administration permissions on the group. No admin account and no network position beyond normal GitLab access is required.
What to do
Upgrade GitLab CE/EE to 19.2.8, 19.3.5, or 19.4.2 per the 19.4.2 patch release and restart the GitLab services - a standard application upgrade, no node reboot. In the interim, audit which custom roles carry compliance framework administration and who holds them, and review recent compliance pipeline runs on group projects.
References
Related entries
- GitLab EE: guest-level user can read private security policy content they are not authorized to seeCVE-2026-10518 · GitLab EE security policy content (authorization enforcement)Medium
- Katello: Docker Tags API leaks repository metadata across organization boundariesCVE-2026-107444 · Katello / Red Hat Satellite 6 (Docker Tags repositories API, organization scoping)Medium
- Grafana: alert rules API returns rules from folders the user cannot readCVE-2026-13719 · Grafana (alert rules API list endpoint, folder authorization)Medium
- GitLab EE: developer-role user can influence the execution environment of Pipeline Execution Policy jobsCVE-2026-15387 · GitLab EE (Pipeline Execution Policy enforcement jobs, job dependency handling)Medium
- GitLab EE: Security Manager role can run arbitrary CI/CD jobs and read protected variablesCVE-2026-16794 · GitLab EE (compliance framework management authorization)Medium
- GitLab EE: authenticated user can view restricted group configuration settingsCVE-2026-18244 · GitLab EE (group settings page authorization)Medium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.