CVE-2026-13210

An improper input validation flaw (CWE-863, incorrect authorization) in GitLab's environment scope pattern matcher lets an authenticated user with low privileges read CI/CD variables scoped to environments they should not have access to, under certain conditions. An attacker triggers it by crafting input that causes the pattern matcher to match outside the intended environment scope, exposing secrets such as deploy tokens, cloud credentials, or API keys stored in CI/CD variables. All self-managed GitLab CE/EE installations from 15.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 are affected (GitLab's own SaaS instance is patched centrally). There is no known public proof-of-concept and the issue is not on the CISA KEV list, so exploitation is not known to be occurring, though it was disclosed alongside a GitLab security release that also covered more severe flaws.

What to do: Upgrade immediately to GitLab 19.1.8, 19.2.6, or 19.3.2 (or later) depending on your minor-version track. Review audit logs for unexpected CI/CD variable reads by low-privileged users and inspect environment-scope configurations on sensitive variables. Treat any secrets stored in CI/CD variables (tokens, keys, cloud credentials) on vulnerable instances as potentially exposed to all authenticated users and rotate them as a precaution.