VulnSocial

CVE-2026-14814

LOWCVSS 8.2 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

GitLab has remediated an issue in GitLab CE/EE affecting all versions before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed a user to poison cached responses for raw repository files, causing targeted users' CI/CD pipelines to execute specially crafted content and potentially exposing protected environment variables, due to improper validation of repository references.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-625

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 2 mentions across 1 observed day

What's happening

  • 2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-10-13: 210-13
Referenced assets2 URLs
Full discourse2 posts
  • VulniPulse@vulnipulse

    CVE advisory: CVE-2026-14814 - gitlab: Permissive Regular Expression in GitLab. https://vulnipulse.com/advisories/gitlab-cve-2026-14814 #CVE #CyberSecurity #GitLab

    1000030
    13 followersView on X
  • Cyb3rVolt3x@AndraxPentester

    @TheHackersNews @TheHackersNews RCE is CWE-190 in the CI/CD regex compiler: crafted regex in pipeline config, no auth. https://GitLab.com/Dedicated already patched. Self-managed: 19.2.8 / 19.3.5 / 19.4.2. Same release closes CVE-2026-14814 (raw-file cache poison → protected env vars).

    0000095
    47 followersView on X

Explore more

Back to dashboard