CVE-2026-14814

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions prior to 19.2.8 GitLab CE/EE versions 19.3 through 19.3.4 GitLab CE/EE versions 19.4 through 19.4.1

Description Improper validation of repository references allows a user to poison cached responses for raw repository files. This can lead to CI/CD pipelines executing specially crafted content for targeted users, which may result in the exposure of protected environment variables. The issue is caused by a permissive regular expression.

Recommendations Update GitLab CE/EE to version 19.2.8 or later. Update GitLab CE/EE to version 19.3.5 or later. Update GitLab CE/EE to version 19.4.2 or later.