GitLab EUVD-2026-98224

Requires an authenticated low-privileged GitLab account (PR:L) with network access to the instance, and the ability to poison the cache for raw repository file responses by supplying crafted repository references (CWE-625, improper reference validation). Exploitation is gated by 'certain conditions' and rated AC:H - the attacker must win specific cache/timing state AND a targeted victim's CI/CD pipeline must fetch and execute the poisoned raw file for impact (secret exposure) to occur. Limiting factors: authentication is mandatory, high attack complexity, and success depends on a victim pipeline actually running the poisoned content rather than default unauthenticated remote code execution.

This is a credible, high-priority issue but not an emergency. The CVSS 8.2 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N) reflects a network-reachable, authenticated (PR:L) flaw with high attack complexity (AC:H) and a scope change (S:C) because a low-privileged attacker can affect OTHER users' CI/CD pipelines and expose their protected environment variables (C:H/I:H). Public exploit code exists (referenced HackerOne report #3832707), which raises practical risk above a theoretical finding. However, there is NO EPSS score and NO SSVC decision data provided, and the CVE is NOT on CISA KEV - so there is no evidence of active exploitation; POC availability and active exploitation are distinct signals and must not be conflated. The AC:H metric and the description's 'under certain conditions' language indicate exploitation is non-trivial and likely requires specific timing/cache state plus a target whose pipeline runs the poisoned content, which tempers the real-world probability despite the high base score. Net: treat as a priority patch for GitLab operators (public POC + protected-secret exposure), but absent KEV/EPSS this is most plausibly opportunistic or targeted rather than mass-exploited.

A low-privileged authenticated GitLab user abuses improper validation of repository references to poison the cached response for a raw repository file. When a targeted victim's CI/CD pipeline subsequently fetches that cached raw file, it executes attacker-crafted content and may leak the victim's protected CI/CD environment variables. A public proof-of-concept is documented in HackerOne report #3832707, lowering the barrier to replication, though the CVSS AC:H rating indicates the specific cache/timing conditions are not trivial to meet.