GitLab: developer-role user can run pipelines on a protected branch without push rights

Impact

Improper authorization in pipeline reference validation lets an authenticated developer-role account start a CI/CD pipeline against a protected branch it is not allowed to push to. Protected branches are where protected CI variables and protected environments unlock, so this hands a lower-privileged account the credentials and deploy paths that build fleet images, publish container tags and drive GitOps rollouts. Where those pipelines also run on self-hosted runners inside the cluster, the same bypass gives a developer job execution in that runner's context. Affects 19.0 before 19.0.6, 19.1 before 19.1.4 and 19.2 before 19.2.2.

Who can reach it

An authenticated GitLab user holding developer-role permissions on the project. No push access to the protected branch and no maintainer/owner role required.

What to do

Upgrade to 19.0.6, 19.1.4 or 19.2.2 per the GitLab 19.2.2 patch release. For a self-managed instance this is a package upgrade and a service restart (Omnibus reconfigure/restart or a Helm chart bump) - no node drain, no fleet impact beyond a short GitLab outage. Afterwards, review pipeline runs on protected branches over the affected window and rotate any protected CI variables that could have been read.

References

Related entries

• GitLab EE: authenticated user can attribute AI usage to another namespaceCVE-2026-19228 · GitLab EE (AI feature usage attribution / request identity authorization)High
• open-iscsi / open-isns - iscsiuio control socket authorization and iSNS record handling: Three related defectsCVE-2026-44944 · open-iscsi / open-isns - iscsiuio control socket authorization and iSNS record handlingHigh
• GitLab EE: developer-level user can run a policy test pipeline and read protected CI/CD variablesCVE-2026-79708 · GitLab EE (security policy test pipelines, CI/CD variable scope validation)High
• GitLab EE: crafted project export import overflows the Advanced Search Unicode buffer for RCECVE-2026-88765 · GitLab EE (Advanced Search indexing, Unicode conversion buffer on project import)High
• Renovate: unescaped Gradle distributionUrl gives a repository command execution as the Renovate userCVE-2026-88886 · Renovate self-hosted (Gradle Wrapper manager, distributionUrl)High
• Renovate: unescaped Maven Wrapper distributionType lets a repository run commands in the botCVE-2026-88889 · Renovate self-hosted (Maven Wrapper manager, distributionType)High