Input Validation Flaw in GitLab CI/CD Variables Affects Multiple Versions
CVE-2026-13210

7.7HIGH

Key Information:

Vendor

Gitlab
Status
Gitlab
Vendor
CVE Published:
15 September 2026

What is CVE-2026-13210?

An input validation flaw in GitLab CE/EE could allow an authenticated user to inadvertently access CI/CD variables outside their designated environment scope. This occurs due to improper validation within the environment scope pattern matcher, affecting several versions of the software. Remediation is essential to mitigate potential unauthorized access to sensitive CI/CD variables, thereby ensuring the integrity and security of the environment.

Affected Version(s)

GitLab 15.7 < 19.1.8

GitLab 19.2 < 19.2.6

GitLab 19.3 < 19.3.2

References

https://gitlab.com/gitlab-org/gitlab/-/work_items/603978
https://hackerone.com/reports/3655211
technical-descriptionexploitpermissions-required

CVSS V3.1

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Thanks [nwicks](https://hackerone.com/nwicks) for reporting this vulnerability through our HackerOne bug bounty program
.