CVE-2026-16301

{
  "etk_id": "ETK-2026-1453",
  "cve_id": "CVE-2026-16301",
  "display_id": "CVE-2026-16301",
  "ghsa_id": "GHSA-4jhf-7f73-gc68",
  "euvd_id": "EUVD-2026-98222",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Protected-branch pipeline authorization bypass in GitLab",
  "summary": "GitLab CE/EE versions 18.7 through before 19.2.8, 19.3 through before 19.3.5, and 19.4 through before 19.4.2 are affected by an authorization flaw in downstream pipeline creation. Under certain conditions, an authenticated Developer could run CI/CD pipelines on protected branches without the required authorization.",
  "mitigation": "Upgrade GitLab to 19.2.8, 19.3.5, or 19.4.2, as applicable. Until upgraded, restrict Developer access and review protected-branch pipeline activity.",
  "vendor": "GitLab",
  "product": "GitLab",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 18.7, < 19.2.8",
        ">= 19.3, < 19.3.5",
        ">= 19.4, < 19.4.2"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "19.2.8",
        "19.3.5",
        "19.4.2"
      ],
      "package_name": "GitLab",
      "purl": null
    }
  ],
  "cwes": [
    863
  ],
  "cvss_score": 8.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N",
  "epss_score": 0.0022,
  "epss_percentile": 0.1131,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 117.65665148333333,
  "t0_at": "2026-10-13T01:08:11.162000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-13T03:53:49.447218+00:00",
      "days": 0.1150264492824074,
      "is_lower_bound": false,
      "measured_at": "2026-10-13T01:08:11.162000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-13T01:08:11.162000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-13T01:08:11.162000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16301"
    }
  }
}