Database/Control plane, storage & DevOps

GitLab: raw-file cache poisoning makes targeted CI/CD pipelines execute attacker content

CVSS 8.2CVE-2026-14814Control plane, storage & DevOpscurated

Impact

Improper validation of repository references lets a user poison the cached responses for raw repository files. A targeted project's CI/CD pipeline then fetches the poisoned content and executes it, which can expose protected environment variables. Anything in a fleet that pulls scripts or manifests from GitLab raw URLs during a pipeline - image builds, node bootstrap, provisioning jobs - is in the blast radius, and the secrets at risk are the protected variables those pipelines hold, typically registry and cluster credentials. Attack complexity is rated high, so this needs the right conditions rather than being trivially repeatable.

Who can reach it

An authenticated GitLab user who can push to or create a repository on the instance, able to influence the cache entry a victim pipeline reads. No victim interaction required.

What to do

Upgrade GitLab CE/EE to 19.2.8, 19.3.5 or 19.4.2 - all versions before 19.2.8 are affected. Application upgrade and service restart. Because the payoff is protected CI variables, rotate credentials exposed to pipelines that fetch raw repository files if you have reason to think this was exercised; the advisory gives no indicator of compromise to check against.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-14814 https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/https://gitlab.com/gitlab-org/gitlab/-/work_items/604950 https://hackerone.com/reports/3832707

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.