GitLab: developer-role user can run pipelines on a protected branch without push rights

Impact

Improper authorization in pipeline reference validation lets an authenticated developer-role account start a CI/CD pipeline against a protected branch it is not allowed to push to. Protected branches are where protected CI variables and protected environments unlock, so this hands a lower-privileged account the credentials and deploy paths that build fleet images, publish container tags and drive GitOps rollouts. Where those pipelines also run on self-hosted runners inside the cluster, the same bypass gives a developer job execution in that runner's context. Affects 19.0 before 19.0.6, 19.1 before 19.1.4 and 19.2 before 19.2.2.

Who can reach it

An authenticated GitLab user holding developer-role permissions on the project. No push access to the protected branch and no maintainer/owner role required.

What to do

Upgrade to 19.0.6, 19.1.4 or 19.2.2 per the GitLab 19.2.2 patch release. For a self-managed instance this is a package upgrade and a service restart (Omnibus reconfigure/restart or a Helm chart bump) - no node drain, no fleet impact beyond a short GitLab outage. Afterwards, review pipeline runs on protected branches over the affected window and rotate any protected CI variables that could have been read.

References