CVE-2026-14814

GitLab CE/EE had a flaw in which improper validation of repository references could let an authenticated user poison cached responses for raw repository files under certain conditions. Targeted users' CI/CD pipelines that then consumed that cached content could execute specially crafted content and potentially expose protected environment variables. The issue is rated high (CVSS 8.2): it is reachable over the network by a low-privileged user with no user interaction, though attack complexity is high and the impact is confidentiality and integrity with changed scope. Self-managed GitLab Community Edition and Enterprise Edition installs before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 are affected. No public proof of concept is known and the CVE is not in the CISA Known Exploited Vulnerabilities catalog.

What to do: Upgrade self-managed GitLab CE/EE to 19.2.8, 19.3.5, or 19.4.2 or later on your release track. After upgrading, review recent CI/CD job logs for unexpected script content and rotate protected environment variables if pipelines may have run poisoned raw-file content.