Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-14814

GitLab has remediated an issue in GitLab CE/EE affecting all versions before 19.2.8, 19.3 before…

Risk score
52/100
CVSS
8.2 v3.1
Exploit chance (30 days)
0.2%
Published
13 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
GitLab has remediated an issue in GitLab CE/EE affecting all versions before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed a user to poison cached responses for raw repository files, causing targeted users' CI/CD pipelines to execute specially crafted content and…
Affected
GitLab before 19.2.8, 19.3, 19.3.5, 19.4, 19.4.2
Fix
Upgrade GitLab to 19.2.8, 19.3, 19.3.5, 19.4 or 19.4.2 (whichever matches your release line), or later.
Exploitation
No known exploitation

Story map

Story map: GitLabTHE FLAWSTHE FIXCVE-2026-14814GitLab has remediated an issuein GitLab CE/EE affecting allversions before 19.2.8, 19.3…CVSS 8.2 · EPSS 0%CVE-2026-97229Integer overflow can lead toremote code executionCVSS 10.0 · EPSS 1%CVE-2026-93577Integer overflow can lead toremote code executionCVSS 9.9 · EPSS 1%CVE-2026-89078Double free can lead to remotecode executionCVSS 9.9 · EPSS 0%Upgrade GitLab19.2.8 · 19.3 · 19.3.5 · 19.4 ·19.4.2 · 19.2.7or later on your release lineWho is exposedGitLab before 19.2.8, 19.3,19.3.5, 19.4, 19.4.2AMBER · PATCH THIS WEEKGitLabGitLab has remediated an issuein GitLab CE/EE affecting allversions from 19.2 before 19.2.8,19.3 before 19.3.5, and 19.4before 19.4.2 that, under certainconditions, could have allowed anunauthenticated user to…Where it standsNo known exploitation1 outlet covering itHOW IT UNFOLDEDOfficial record on the left, the press on the right, oldest first.22 Oct · BleepingComputerGitLab warns of new max severity code executionvulnerabilityCONNECTS TOSame weaknessCWE-625 (CWE-625)2 other warnings in 30 days →Same productEarlier GitLab warnings31 in the last 90 days →Reported alongsideGitLab Community Edition andEnterprise Edition Path…CVE-2026-85706 · in 1 of the samearticle →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

GitLab: Amber, patch this week. GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD confi…

The flaws

  • CVE-2026-14814: GitLab has remediated an issue in GitLab CE/EE affecting all versions before 19.2.8, 19.3 before… (CVSS 8.2 · EPSS 0%)
  • CVE-2026-97229: Integer overflow can lead to remote code execution (CVSS 10.0 · EPSS 1%)
  • CVE-2026-93577: Integer overflow can lead to remote code execution (CVSS 9.9 · EPSS 1%)
  • CVE-2026-89078: Double free can lead to remote code execution (CVSS 9.9 · EPSS 0%)

The fix

Upgrade GitLab: 19.2.8 · 19.3 · 19.3.5 · 19.4 · 19.4.2 · 19.2.7 or later on your release line

Who is exposed: GitLab before 19.2.8, 19.3, 19.3.5, 19.4, 19.4.2

Where it stands

  • No known exploitation
  • 1 outlet covering it

How it unfolded

  1. 22 Oct, BleepingComputer (press): GitLab warns of new max severity code execution vulnerability

Connects to

Why it is Yellow

  • CVSS 8.2 high

References

Original description

GitLab has remediated an issue in GitLab CE/EE affecting all versions before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed a user to poison cached responses for raw repository files, causing targeted users' CI/CD pipelines to execute specially crafted content and potentially exposing protected environment variables, due to improper validation of repository references.

Last activity 13 Oct 2026. Patch Forecast updates every hour.