CVE-2026-14814

Think of GitLab's file cache like a shared filing cabinet used by an automated assembly line. This bug lets someone slip a mislabeled folder into that cabinet, so when the assembly line (your automated builds) grabs what it thinks is the right file, it actually runs instructions from the attacker instead — and those instructions can steal the keys locked inside the building (your secret credentials).

This matters to you if you self-host or run GitLab CE/EE for source code and automated builds (CI/CD pipelines). It affects the default setup — no special configuration is needed to be exposed — but an attacker needs at least a low-privilege account on your GitLab instance to exploit it.

This is a high-severity issue that's reachable with just a low-privilege account and no user interaction, letting an attacker reach into other users' automated build systems and steal protected secrets — that combination warrants treating it as urgent even though no active exploitation has been confirmed yet. Don't wait for evidence of attacks before patching; the ease of triggering it and the sensitivity of what it exposes make delay risky.

Confirm exposure by checking your GitLab CE/EE version against the affected ranges: before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. Upgrade to the fixed version matching your branch (19.2.8, 19.3.5, or 19.4.2) or any later release — see GitLab's patch release notes at https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/ for upgrade guidance and any breaking-change notes for your branch. There is no documented workaround short of patching; if you cannot patch immediately, restrict who has repository/project access to limit which users could attempt the cache-poisoning preconditions, and avoid storing highly sensitive secrets in protected CI/CD variables until patched. After upgrading, audit recent pipeline execution logs for anomalous job content or unexpected cache behavior, and rotate protected environment variables that were in use prior to the patch as a precaution. No CISA KEV listing exists for this CVE, so there is no federal remediation deadline, but the severity and low exploitation bar justify prioritizing this in your normal patch cycle.

CVSS 8.2 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N) reflects network-reachable, scope-changed impact to confidentiality and integrity with no availability loss; weakness is CWE-625 (Permissive Regular Expression) in repository reference validation leading to raw file cache poisoning. Exploitation requires low privileges, no user interaction, and a specific cache state attacker must induce via crafted repository references — attack complexity is rated high due to these preconditions. No public exploit code exists, the issue is not in CISA's KEV catalog, and EPSS prediction places likelihood of near-term exploitation in the wild in the lower percentile with a flat trend, consistent with no confirmed in-the-wild activity to date. Press attention is rising but reflects a vulnerability roundup rather than reported incidents.