GitLab: Developer role can run CI/CD pipelines on protected branches via downstream pipeline creation

Impact

Improper authorization in the downstream pipeline creation service lets an authenticated user with only the Developer role trigger CI/CD pipelines on protected branches. Protected branches are the control that decides which code can reach production runners and which jobs can use protected CI variables and deploy credentials, so this is a path from ordinary repository write access to running jobs in the trusted context. For a datacenter that drives fleet automation, image builds or node provisioning from GitLab CI, that trusted context is the one holding registry push rights and cluster credentials. CVSS scope is marked changed, reflecting the crossing of that boundary.

Who can reach it

An authenticated GitLab user holding the Developer role on an affected project. No user interaction needed.

What to do

Upgrade GitLab CE/EE to 19.2.8, 19.3.5 or 19.4.2. Versions from 18.7 are affected. This is a GitLab application upgrade and service restart, not a node-level change; self-managed operators should also review protected-branch pipeline runs and any protected-variable usage from the exposure window, since the advisory does not indicate the flaw leaves distinctive traces.

References

Related entries

• GitLab EE: authenticated user can attribute AI usage to another namespaceCVE-2026-19228 · GitLab EE (AI feature usage attribution / request identity authorization)High
• open-iscsi / open-isns - iscsiuio control socket authorization and iSNS record handling: Three related defectsCVE-2026-44944 · open-iscsi / open-isns - iscsiuio control socket authorization and iSNS record handlingHigh
• GitLab EE: developer-level user can run a policy test pipeline and read protected CI/CD variablesCVE-2026-79708 · GitLab EE (security policy test pipelines, CI/CD variable scope validation)High
• GitLab EE: crafted project export import overflows the Advanced Search Unicode buffer for RCECVE-2026-88765 · GitLab EE (Advanced Search indexing, Unicode conversion buffer on project import)High
• Renovate: unescaped Gradle distributionUrl gives a repository command execution as the Renovate userCVE-2026-88886 · Renovate self-hosted (Gradle Wrapper manager, distributionUrl)High
• Renovate: unescaped Maven Wrapper distributionType lets a repository run commands in the botCVE-2026-88889 · Renovate self-hosted (Maven Wrapper manager, distributionType)High