Arbitrary Code Execution Vulnerability in GitLab EE
CVE-2026-81839

7.7HIGH

Key Information:

Vendor

Gitlab
Status
Gitlab
Vendor
CVE Published:
13 October 2026

What is CVE-2026-81839?

GitLab EE has addressed a security flaw that permitted authenticated users to execute arbitrary CI/CD pipelines in transferred projects. This issue stemmed from insufficient cleanup of scheduled pipeline execution policy records, enabling exploitation under specific circumstances. The affected versions include GitLab EE from 18.1 through various updates leading up to 19.4.2. It is crucial for users to upgrade to the patched versions to mitigate the risk of unauthorized code execution.

Affected Version(s)

GitLab 18.1 < 19.2.8

GitLab 19.3 < 19.3.5

GitLab 19.4 < 19.4.2

References

https://gitlab.com/gitlab-org/gitlab/-/work_items/624150
https://hackerone.com/reports/3925062
technical-descriptionexploitpermissions-required
https://docs.gitlab.com/releases/patches/patch-release-gi...

CVSS V3.1

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Thanks [no_01](https://hackerone.com/no_01) for reporting this vulnerability through our HackerOne bug bounty program
.