What is the CVSS score of CVE-2026-12436?

CVE-2026-12436 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L. EPSS exploitation probability: 0.3%.

Which versions of GitLab are affected by CVE-2026-12436?

GitLab CE/EE through version 19.2.1 contains CVE-2026-12436, a high-severity flaw allowing authenticated users to hijack CI/CD pipelines owned by others and inject malicious code.. A patch is available.

Is there a public PoC exploit available for CVE-2026-12436?

Yes, a public proof-of-concept exploit is available for CVE-2026-12436. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-12436?

Within 24 hours: identify all GitLab instances running affected versions (18.0-19.0.5, 19.1-19.1.3, 19.2-19.2.1) and restrict pipeline schedule modification permissions to pipeline owners pending patching. Within 7 days: deploy vendor-released patches (GitLab 19.0.6 or later, 19.1.4 or later, 19.2.2 or later) to all affected instances and confirm deployment versions. Within 30 days: audit GitLab audit logs for pipeline schedule changes during the exposure window; investigate any unauthorized modifications and remediate affected pipelines for injected code.

GitLab CVE-2026-12436

EUVD-2026-50482 HIGH

Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915)

2026-07-29 GitLab

GHSA-94p8-87ff-w336

Information Disclosure Gitlab

8.4

CVSS 3.1 · Vendor: GitLab

Severity by source

Vendor (GitLab) PRIMARY

8.4 HIGH

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L

vuln.today AI

8.4 HIGH

Network-reachable but needs an authenticated account (PR:L) and attacker-uncontrollable conditions (AC:H); mass-assignment lets one user alter another's config, changing scope (S:C) with high C/I and limited availability impact.

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N

Primary rating from Vendor (GitLab).

CVSS VectorVendor: GitLab

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Patch available

Jul 29, 2026 - 20:02 EUVD

Analysis Generated

Jul 29, 2026 - 19:57 vuln.today

CVE Published

Jul 29, 2026 - 19:00 cve.org

HIGH 8.4

DescriptionCVE.org

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to modify CI/CD configuration belonging to another user due to improper validation of user-supplied attributes when processing pipeline schedule inputs.

Articles & Coverage 2

News 3 New GitLab Vulnerabilities - 3 High Severity, 2 With POC Jul 30, 2026 News 3 New GitLab Vulnerabilities - 3 High Severity, 2 With POC Jul 29, 2026

AnalysisAI

Improper attribute validation in GitLab CE/EE (18.0 through 19.0.5, 19.1 through 19.1.3, 19.2 through 19.2.1) lets an authenticated user tamper with CI/CD configuration owned by another user by injecting user-controlled attributes into pipeline schedule input processing. Publicly available exploit code exists (HackerOne #3800511), though the flaw is not listed in CISA KEV and requires authentication plus high-complexity conditions to trigger. GitLab, the reporter, has shipped fixed releases across all supported branches.

Technical ContextAI

This is a CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes, i.e. mass-assignment) defect in GitLab's pipeline scheduling subsystem. When GitLab processes pipeline schedule inputs, it binds user-supplied attributes to internal objects without adequately restricting which attributes a caller may set, allowing an attacker to reach and overwrite CI/CD configuration fields belonging to another user's context. The single affected CPE is cpe:2.3:a:gitlab:gitlab (all editions, CE and EE), and the mass-assignment class typically arises in Ruby on Rails applications when permitted-parameter allowlists are missing or too broad on model updates.

RemediationAI

Vendor-released patch: upgrade to GitLab 19.0.5, 19.1.3, or 19.2.1 (or later) depending on your branch, as documented at https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-1-released/. Both CE and EE self-managed installations should apply the corresponding patch release immediately; GitLab.com is maintained by the vendor. If an upgrade cannot be scheduled at once, reduce exposure by limiting who can create or edit pipeline schedules - restrict membership and Developer/Maintainer roles on shared projects and audit pipeline schedule and CI/CD configuration changes - accepting the trade-off that this constrains legitimate CI/CD workflow for those users; there is no documented feature-level toggle that disables pipeline schedule input processing without breaking scheduling functionality, so upgrading is the definitive fix.