GitLab 19.4.1 / 19.3.3 / 19.2.7 (2026-09-23): two CVSS 9.9 authenticated RCEs from a crafted regular expression in a CI/CD configuration (CVE-2026-89078 double free, CVE-2026-93577 integer overflow), plus four AI-feature bugs — Duo troubleshooting leaks CI/CD variable values, an MCP-scoped token acts beyond its scope, Duo Workflow governance bypass, MCP search returns another user's results

View raw markdownEdit on GitHub ↗

TL;DR

GitLab's critical patch release of 2026-09-23 — 19.4.1, 19.3.3, 19.2.7 — fixes eleven vulnerabilities, two of them CVSS 9.9 Critical and both the same shape: an authenticated user could execute arbitrary code on the GitLab server by putting a specially crafted regular expression in a CI/CD configuration — CVE-2026-89078 (a double free in the regex parser, CWE-415) and CVE-2026-93577 (an integer overflow in the regex compiler, CWE-190), both reported by joaxcar via HackerOne, both affecting 19.2 before 19.2.7, 19.3 before 19.3.3 and 19.4 before 19.4.1. NVD scored both 9.9 on 2026-09-24 (AV:N/AC:L/PR:L/UI:N/S:C). Any user who can push a .gitlab-ci.yml — every developer on a self-managed instance, every external contributor whose merge-request pipelines run — is "authenticated." The same release carries four AI-feature fixes the headline hides: CVE-2026-92470 (7.7) — the Duo AI job-troubleshooting feature let an authenticated user read sensitive CI/CD variable values from debug-mode job traces; CVE-2026-92874 (5.4) — an MCP-scoped token could "perform actions beyond the intended scope of that token" (18.3+); CVE-2026-92529 (4.3) — a developer could bypass admin-configured AI tool governance for Duo Workflow; CVE-2026-92628 (3.1) — a race in the MCP gitlab_search tool "could cause results to return under incorrect user context." Also fixed: an 8.7 stored XSS in the merge-request diff viewer (CVE-2026-84739, 13.11+) and an unauthenticated read of CI job traces with variable values (CVE-2026-4523, 15.11+). GitLab.com is patched; "we strongly recommend all installations upgrade immediately." Second critical GitLab release in two weeks after CVE-2026-85706's KEV entry.

What happened

The two RCEs. GitLab's patch post describes them in near-identical words. CVE-2026-89078: "An authenticated user could execute arbitrary code on the GitLab server due to a double free issue when parsing a specially crafted regular expression" in a CI/CD configuration; CVE-2026-93577: "…due to an integer overflow when compiling a specially crafted regular expression in a CI/CD configuration." Both are CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H (the double free is A:L, the overflow A:H), both are scope-changed — code runs on the GitLab server, not in a runner — and both were found by the same HackerOne researcher (joaxcar; reports #4019059 and #3995696). The affected range is narrow (the regex engine path was introduced in 19.2, so 19.1 and earlier are not listed), but 19.2–19.4 is the current release train. The vector is the CI/CD configuration itself: .gitlab-ci.yml rules:/only:/except: regexes and similar fields are evaluated on the server when a pipeline is created, so the exploit is a commit, a merge request from a fork with pipelines enabled, or an API call that creates a pipeline with an inline configuration.

The AI-feature batch. Four of the eleven fixes are in Duo or MCP surfaces, none critical on its own but each a scope failure of the kind this corpus tracks for GitLab's MCP server and Duo Chat:

CVE CVSS Component GitLab's description
CVE-2026-92470 7.7 High Duo AI job troubleshooting (EE 18.7+) "An authenticated user could access sensitive CI/CD variable values from debug-mode job traces through the Duo AI troubleshooting feature"
CVE-2026-92874 5.4 Medium MCP API scope enforcement (CE/EE 18.3+) "An authenticated user with an MCP-scoped token could perform actions beyond the intended scope"
CVE-2026-92529 4.3 Medium Duo Workflow Service token governance (EE 19.1+) "A developer could bypass admin-configured AI tool governance controls for workflows"
CVE-2026-92628 3.1 Low MCP gitlab_search tool (CE/EE 18.6+) "Race condition in MCP search tool could cause results to return under incorrect user context"

The Duo troubleshooting bug is the one to act on: a debug-mode job trace contains the values of masked variables, and the feature that summarises "why did this job fail?" for the model was reading traces its caller could not. The MCP-scope bug matters for anyone who minted a narrow token for a coding agent — the narrowing did not hold. All four were found internally (Daniel Prause, Amr Taha, Rahul Barnwal, Chris Bonk).

The rest. CVE-2026-84739 (8.7 High, 13.11+): stored XSS in the merge-request diff viewer — "an authenticated user could execute arbitrary JavaScript in another user's browser session," which on a source host is a session-theft primitive. CVE-2026-4523 (3.7 Low, 15.11+): "an unauthenticated user could read CI/CD job trace contents with sensitive variable values" through the GraphQL job-trace API — low CVSS because of the high attack complexity, but the payload is secrets. Plus authorship spoofing in Direct Transfer imports (CVE-2026-92530), private child-issue reads via the Epic Issues API (CVE-2026-8937), and a GraphQL resolver leaking security-policy content to guests (CVE-2026-10518).

Why it matters for vibe coders. A self-managed GitLab is the CI, the registry proxy and increasingly the agent host (Duo agents, the MCP server) for teams that left GitHub; a 9.9 reachable from a .gitlab-ci.yml means any contributor with a merge request — or any coding agent with push rights — can run code on the box that holds every project's secrets. And the four AI-feature bugs are all the same lesson as the corpus's other agent-platform entries: the new surface (a troubleshooting summariser, an MCP scope, a workflow governance switch) was wired to data the caller should not have had.

Am I affected?

  • RCE-affected if: self-managed GitLab CE/EE 19.2.0–19.2.6, 19.3.0–19.3.2 or 19.4.0, with any user or bot able to create pipelines (including fork merge-request pipelines).
  • Duo/MCP-affected if: EE with Duo enabled on 18.7–19.4.0 (troubleshooting leak), any edition 18.3+ using MCP-scoped tokens, EE 19.1+ using Duo Workflow governance, any edition 18.6+ with the MCP gitlab_search tool.
  • Not affected: 19.4.1 / 19.3.3 / 19.2.7 and later; GitLab.com (already patched); GitLab Dedicated per GitLab's standard patch process.
# Version
curl -s -H "PRIVATE-TOKEN: $GITLAB_TOKEN" "https://gitlab.example.com/api/v4/version"
# Who can create pipelines from forks? (MR pipelines from forks run the fork's .gitlab-ci.yml on your instance)
# Settings → CI/CD → "Pipelines for merge requests from forks" — review per project.
# Debug-mode job traces (CI_DEBUG_TRACE) that Duo troubleshooting could have read
grep -rn "CI_DEBUG_TRACE" --include=.gitlab-ci.yml . 2>/dev/null
# MCP-scoped tokens minted for agents
curl -s -H "PRIVATE-TOKEN: $GITLAB_TOKEN" "https://gitlab.example.com/api/v4/personal_access_tokens?state=active" | grep -i mcp

If you are affected

  1. Upgrade now to 19.4.1, 19.3.3 or 19.2.7. There is no listed workaround for the RCEs.
  2. If the instance ran an affected version with external contributors or agents able to create pipelines, review pipeline creation events for the window (from whenever the instance first ran a 19.2.x release) for CI configurations containing unusual regexes, and treat a suspicious hit as server compromise: → playbooks/if-your-webapp-was-compromised.md, then rotate every CI/CD variable, runner registration token and integration secret the instance held — → playbooks/rotating-cloud-credentials.md.
  3. If Duo troubleshooting was enabled with debug-mode traces (CVE-2026-92470) or the GraphQL job-trace API was reachable unauthenticated (CVE-2026-4523), rotate the masked variables those jobs used; masking does not survive CI_DEBUG_TRACE.
  4. Re-mint MCP-scoped tokens after upgrading and audit what they were used for; the scope was advisory until 19.4.1.

Prevention

  • Treat CI configuration as server-side code. A .gitlab-ci.yml is parsed by the GitLab server; restrict who can create pipelines (disable fork MR pipelines, or require approval) and keep the instance on the current patch. prevention/ci-cd-hardening.md.
  • Never run CI_DEBUG_TRACE in jobs that hold real secrets — two of this release's eleven bugs are "someone could read a debug trace." prevention/credential-hygiene.md.
  • Scope tokens, then verify the scope. An MCP-scoped or agent-scoped token is only as narrow as the server enforces; test a minted token against an out-of-scope call before trusting it in an agent's config. prevention/mcp-hygiene.md.
  • Subscribe to GitLab's patch-release feed (docs.gitlab.com/releases/patches/); this is the second critical in two weeks and GitLab ships fixes on a fixed cadence with no pre-announcement of severity.

Sources