GitLab Patches 13 Security Flaws, Including CI/CD Pipeline Tampering and a Duo Code Review Prompt-Injection Bug

Overview

GitLab released patched versions 19.2.1, 19.1.3, and 19.0.5 for its Community and Enterprise editions on July 29, 2026, fixing 13 vulnerabilities according to GitLab’s official release notes. Three of the flaws carry high-severity ratings, and the batch touches CI/CD pipeline configuration, an AI-assisted code review feature, and unauthenticated denial-of-service exposure, as reported by GBHackers and Cyber Security News.

What We Know

The most severe issue, CVE-2026-6267, sits in GitLab Workhorse and carries a CVSS score of 8.5, according to GBHackers. It stems from insufficient access controls on internal request handling, which could let an authenticated user with the Developer role retrieve sensitive information they should not be able to see, according to Cyber Security News.

A second high-severity flaw, CVE-2026-12436, carries a CVSS score of 8.4 and affects the Pipeline Schedule API, according to GBHackers. Improper validation of user-supplied attributes could let an authenticated attacker modify CI/CD configurations belonging to other users, potentially leading to unauthorized pipeline executions, according to Cyber Security News, which described a scenario where a low-privilege developer exploits the flaw to modify scheduled jobs in another project and inject malicious scripts into the CI/CD pipeline, risking a supply-chain compromise.

The third high-severity issue, CVE-2026-15975, carries a CVSS score of 7.5 and allows unauthenticated attackers to exhaust server resources through insufficient throttling in merge request discussions, according to GBHackers.

Among the medium-severity fixes, two touch GitLab’s Duo AI tooling. CVE-2026-15077, rated 4.3, is a prompt-injection vulnerability in Duo Code Review that could let an authenticated user access information from projects they are not authorized to view, according to GBHackers. CVE-2026-15831, also rated 4.3, involves incorrect security token generation in Duo Workflows and could let an authenticated user bypass administrator-configured tool governance policies, according to GBHackers. A separate race-condition flaw, CVE-2026-13113 (CVSS 6.5), affects GitLab Enterprise Edition and could let an authenticated user merge code into a protected branch without the required approvals, also according to GBHackers.

The remaining medium-severity fixes address improper authorization in project imports, unauthorized access to pipeline test-report contents, and cross-site scripting vulnerabilities, according to Cyber Security News. GitLab’s release notes describe the full set of 13 fixes as spanning Community Edition and Enterprise Edition deployments, and advise that all self-managed GitLab installations be upgraded to one of the three patched versions immediately, noting that GitLab.com is already running the patched code and that GitLab Dedicated customers do not need to take any action, according to GitLab.

What We Don’t Know

GitLab’s release notes and both outlets covering the patch do not indicate whether any of the 13 vulnerabilities were exploited in the wild before the July 29 fixes shipped. The exact CVSS scores for several of the lower-severity fixes, and full technical proof-of-concept details for any of the flaws, have not been published in the sources reviewed.