Cache Poisoning Vulnerability in GitLab CE/EE
CVE-2026-14814

8.2HIGH

Key Information:

Vendor

Gitlab
Status
Gitlab
Vendor
CVE Published:
13 October 2026

What is CVE-2026-14814?

A vulnerability in GitLab CE/EE allows for cache poisoning under specific conditions, enabling attackers to manipulate cached responses for raw repository files. This may lead to the execution of specially crafted content in targeted users' CI/CD pipelines, thereby potentially exposing sensitive protected environment variables due to inadequate validation of repository references.

Affected Version(s)

GitLab 0 < 19.2.8

GitLab 19.3 < 19.3.5

GitLab 19.4 < 19.4.2

References

https://gitlab.com/gitlab-org/gitlab/-/work_items/604950
https://hackerone.com/reports/3832707
technical-descriptionexploitpermissions-required
https://docs.gitlab.com/releases/patches/patch-release-gi...

CVSS V3.1

Score:
8.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Thanks [ahacker1](https://hackerone.com/ahacker1) for reporting this vulnerability through our HackerOne bug bounty program
.