CVE-2026-13210

Incorrect Authorization in GitLab

Published: Sep 15, 2026Updated: Sep 20, 2026 Sources: CVE List NVDCWE-863

7.7HIGH

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user to access CI/CD variables outside their intended environment scope due to improper input validation in the environment scope pattern matcher.

In plain language

AI Worth attention

gitlab versions from 15.7 through affected 19.1, 19.2, and 19.3 releases can let a signed-in user view deployment secrets meant for another environment; businesses running gitlab should upgrade.

Executive summary

Authenticated incorrect authorization in gitlab’s environment-scope pattern matcher can expose CI/CD variables outside their intended environment scope.

If affected, business impact

Deployment password exposureEnvironment secret exposureUnauthorized project access

What to do now

Check the version of each gitlab server you run and identify whether it is below the corrected release for its version branch.
Upgrade 19.1 installations to 19.1.8 or later, 19.2 installations to 19.2.6 or later, and 19.3 installations to 19.3.2 or later.
After upgrading, review and replace sensitive deployment passwords or keys stored in automated-build settings where appropriate.

Usually a quick update

What is it

gitlab can store passwords and keys used when software is built or deployed. This flaw is like giving someone with access to one locked supply cabinet a way to see the labels and contents of another cabinet they were not meant to open.

Who is affected

This matters to you if you run gitlab for software projects and store deployment passwords, keys, or other secrets in its automated build and deployment settings. It is only a risk when an attacker already has a gitlab login.

How urgent is it

Treat this as an amber-priority upgrade because a signed-in user may be able to access secrets outside their intended boundary. No known public exploit code exists, and this issue is not listed in CISA’s catalog of vulnerabilities known to be exploited.

What to do — in detail

Confirm exposure by inventorying all gitlab instances and their installed versions, then identify projects that use CI/CD variables with environment scopes.

Upgrade supported branches to 19.1.8 or later for 19.1, 19.2.6 or later for 19.2, or 19.3.2 or later for 19.3. Plan the normal GitLab upgrade path if moving between major or minor releases; the findings do not identify a breaking-change requirement for these patch releases.

If upgrading is delayed, restrict access to projects containing sensitive CI/CD variables to trusted accounts and rotate values that may have been readable outside their intended scope. Review available gitlab audit and job logs for unexpected activity involving protected environments; specific compromise indicators are not yet known. CISA has not assigned a KEV due date because this CVE is not listed in KEV.

Technical context

Severity is High: CVSS 7.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N). The issue is CWE-863 incorrect authorization, caused by improper input validation in the environment-scope pattern matcher, allowing an authenticated network attacker with low privileges to access CI/CD variables outside the intended environment scope. It is not in CISA KEV, no public exploit code is recorded, and EPSS is 0.4% (29th percentile) with a flat trend; exploit maturity is therefore no known public exploit.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

CVSS Vector Breakdown

Exploitability

AV:NAttack Vector

Network

AC:LAttack Complexity

Low

PR:LPrivileges Required

Low

UI:NUser Interaction

None

Scope

S:CScope

Changed

Impact

C:HConfidentiality

High

I:NIntegrity

None

A:NAvailability

None

Open in CVSS calculator →

Weaknesses

CWE-863

Affected Products

GitLab

commercial·NLaka gitlab ce/ee

GitLabSaaSWeb App

DevTools & CI / ci-cd

Exploitability

Official Patch Available

Is your org exposed to CVE-2026-13210?Request an assessment to establish which checks are appropriate for your systems. Check my exposure

Attack Graph

Products CVE Techniques Tactics

Click technique nodes for MITRE ATT&CK details · drag to pan · Ctrl/⌘ + scroll to zoom, or go fullscreen.

MITRE ATT&CK

2 techniques

Initial Access

View detailed technique mapping

References

https://gitlab.com/gitlab-org/gitlab/-/work_items/603978

gitlab.com

https://hackerone.com/reports/3655211

hackerone.com

Unlock Complete Vulnerability Intelligence

Get the full picture for CVE-2026-13210 and every CVE in our database. Create a free account — no credit card required.

Create Free Account

Plain-language analysis

Impact assessment and exploitation scenario in plain English

Attack graph visualization

Interactive attack path and kill chain mapping

Exploit details & PoC links

ExploitDB, Metasploit, GitHub PoCs with direct links

Nuclei scanner templates

Ready-to-use vulnerability scanner templates

Full remediation guide

Patch instructions, workarounds, and compliance impact

Interactive AI chat

Ask questions about this vulnerability in natural language

Related vulnerabilities

Semantically similar CVEs and attack patterns

REST API & MCP access

Integrate vulnerability data into your workflows