CVE-2026-89078

Summary

The flaw is a double free issue in GitLab's CI/CD configuration parsing, allowing an authenticated user to execute arbitrary code on the server. This is critical as it can lead to full server compromise.

Exploitability

Exploitation requires an authenticated user with access to a specially crafted regular expression in a CI/CD configuration. The attacker must have the ability to inject such a configuration.

Blast radius

If exploited, the attacker could gain full control over the GitLab server, potentially leading to data theft, service disruption, and further lateral movement within the network.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to GitLab CE/EE 19.2.7 or later, 19.3.3 or later, or 19.4.1 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.