CVE-2026-15387
Received Received - Intake

Authenticated Pipeline Job Dependency Exploitation in GitLab EE

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: GitLab Inc.

Description
GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with developer-role permissions could have influenced the execution environment of Pipeline Execution Policy enforcement jobs, due to improper handling of job dependencies.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-26
Last Modified
2026-08-26
Generated
2026-08-26
AI Q&A
2026-08-26
EPSS Evaluated
N/A
NVD
CVE-2026-15387
EUVD
EUVD-2026-66429

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
gitlab gitlab_ee From 19.1 (inc) to 19.1.7 (exc)
gitlab gitlab_ee From 19.2 (inc) to 19.2.5 (exc)
gitlab gitlab_ee From 19.3 (inc) to 19.3.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-349 The product, when processing trusted data, accepts any untrusted data that is also included with the trusted data, treating the untrusted data as if it were trusted.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in GitLab EE allows an authenticated developer-role user to influence the execution environment of Pipeline Execution Policy enforcement jobs due to improper handling of job dependencies. It affects versions before 19.1.7, 19.2.5, and 19.3.1.

Impact Analysis

An attacker with developer permissions could manipulate enforcement job environments, potentially leading to unauthorized actions or data exposure within the pipeline. The impact is limited to job execution environments and does not directly expose sensitive data.

Compliance Impact

This vulnerability could indirectly impact compliance by allowing unauthorized modifications to pipeline environments, potentially violating integrity controls required by GDPR or HIPAA. However, no direct data exposure is mentioned.

Mitigation Strategies

Upgrade GitLab EE to version 19.1.7, 19.2.5, or 19.3.1 or later to address the improper handling of job dependencies in Pipeline Execution Policy enforcement jobs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15387. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart