CVE-2026-16301
GitLab Critical Patch Release: 19.4.2, 19.3.5, 19.2.8
Published Oct 12, 2026 · updated Oct 14, 2026 · GitLab GitLab
On October 12, 2026, we released versions 19.4.2, 19.3.5, 19.2.8 for GitLab Community Edition (CE) and Enterprise Edition (EE). 19.3.4 had a bug that affected merge request pages when the Ona integration was enabled. This is fixed in 19.3.5. These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action. GitLab releases fixes for vulnerabilities in patch releases. There are two t
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 13, 2026 · NIST NVD
Detected
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with Developer role to execute CI/CD pipelines on protected branches without authorization due to improper authorization checks in the downstream pipeline creation service.
Oct 14, 2026 · NIST NVD
Updated
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with Developer role to execute CI/CD pipelines on protected branches without authorization due to improper authorization checks in the downstream pipeline creation service.
Oct 14, 2026 · NIST NVD
Updated
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with Developer role to execute CI/CD pipelines on protected branches without authorization due to improper authorization checks in the downstream pipeline creation service.
Affected
- cpe gitlab/gitlabversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-16301
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2026-16301
30-day exploitation probability 0.2%
first.org - GitLab Security ReleasesVendor advisoryCVE-2026-16301
On October 12, 2026, we released versions 19.4.2, 19.3.5, 19.2.8 for GitLab Community Edition (CE) and Enterprise Edition (EE). 19.3.4 had a bug that affected merge request pages when the Ona integration was enabled. This is fixed in 19.3.5. These versions contain important bug a
docs.gitlab.com - NIST NVDVulnerability recordCVE-2026-16301
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with Developer role to execute CI/CD pipelines on protected branches
nvd.nist.gov