GitLab’s CI Regex Parser Hid Two 9.9 RCEs — and Its AI Features Needed Four More Fixes
On September 23, GitLab shipped a critical patch release — 19.4.1, 19.3.3, and 19.2.7 for Community and Enterprise editions — fixing eleven security flaws. The two that earned the “critical” label are both memory-safety bugs in the regular-expression handling for CI/CD configurations, both rated CVSS 9.9, both reachable by any authenticated user, and both reported by the same HackerOne researcher, joaxcar. GitLab.com is already patched; GitLab Dedicated customers need no action. Everyone self-hosting should upgrade immediately.
For agent-security teams the headline pair is only half the story. Four of the remaining nine fixes sit directly on GitLab’s AI surface — Duo troubleshooting, Duo Workflow governance, MCP API scopes, and the MCP gitlab_search tool — plus an unauthenticated read of CI job traces. A GitLab server is where source code, CI secrets, deployment credentials, and tokens live; it is also increasingly where coding agents authenticate. This patch touches both halves of that trust.
Two regexes, two 9.9s
CVE-2026-89078 is a double-free in the regular-expression parser: a crafted regex submitted through a CI/CD configuration could corrupt server memory and yield arbitrary code execution. CVE-2026-93577 is an integer overflow in the regex compiler on the same input path, with the same consequence. Both score 9.9 under CVSS 3.1 with network attack vector, low complexity, low privileges, no user interaction, and changed scope (AV:N/AC:L/PR:L/UI:N/S:C); they differ only in the availability component — high for the overflow, low for the double-free.
Both affect only the 19.x line from 19.2 up to the patched releases (19.2 before 19.2.7, 19.3 before 19.3.3, 19.4 before 19.4.1). The “authenticated” precondition should not comfort anyone: most GitLab instances hand accounts to developers, contractors, external collaborators, and CI service users. A low-privileged account plus a YAML file is the whole attack chain, and the prize is the server that holds the CI variables.
The AI-adjacent flaws, in order of sting
CVE-2026-92470 (CVSS 7.7, EE). GitLab’s Duo AI job-troubleshooting feature was missing authorization checks, letting an authenticated user pull sensitive CI/CD variable values out of debug-mode job traces. Found internally by GitLab’s Daniel Prause. This is the flaw agents make worse: an agentic troubleshooting loop that routinely reads job output will happily ingest secrets it was never entitled to, and then carry them into prompts, logs, and follow-up tool calls.
CVE-2026-4523 (CVSS 3.7, CE/EE). The GraphQL CI job-trace API allowed an unauthenticated user to read job-trace contents, including sensitive variable values, on instances going back to 15.11. Reported by scyoon. Pair it with the Duo finding and the pattern is clear: job traces are a secrets-bearing surface that two independent code paths failed to guard.
CVE-2026-92874 (CVSS 5.4, CE/EE). Incorrect authorization in MCP API scope enforcement let an authenticated user with an MCP-scoped token act beyond the token’s intended scope. Found internally by Amr Taha; affected versions stretch back to 18.3. Scoped tokens are the control enterprises reach for when connecting agents — this bug made the scope advisory.
CVE-2026-92628 (CVSS 3.1, CE/EE). A race condition in the MCP gitlab_search tool’s shared state could return search results under the wrong user context. Found internally by Chris Bonk. The score is low and the trigger is a race, but the failure mode — one user’s search results served to another — is exactly the cross-tenant contamination class that matters when agents from different trust levels share a search backend.
CVE-2026-92529 (CVSS 4.3, EE). A developer-role user could bypass admin-configured AI tool governance controls for Duo Workflow Service tokens in namespaces they do not control. Found internally by Rahul Barnwal. Governance bypasses for AI tooling deserve attention out of proportion to their CVSS: the control exists so administrators can say “these agents may not run here,” and the bug let a non-admin answer differently.
The rest of the eleven
CVE-2026-84739 (CVSS 8.7) is stored XSS in the merge-request diff viewer via unsanitized path components — a third joaxcar find, reaching back to 13.11, and the most phishable bug in the batch. CVE-2026-92530 (4.3) lets Direct Transfer imports spoof merge-request authorship onto arbitrary users. CVE-2026-8937 (4.3) exposes private child-issue contents through the Epic Issues REST API. CVE-2026-10518 (4.3) lets a guest-role user read private security-policy content via a GraphQL resolver. None of these is AI-specific; all of them feed the identity-confusion and content-spoofing primitives that prompt-injection chains are built from.
Note the lineage: this is the second GitLab MCP security story this month, after the unauthenticated token-theft and DNS-rebinding flaws in the third-party @zereight/mcp-gitlab package. That one was the ecosystem; this one is the platform itself shipping MCP scope and search-context fixes in the same release as CI-parser RCE.
What to do
- Upgrade self-managed instances now: 19.4.1, 19.3.3, or 19.2.7 depending on your track. All deployment types are affected where no specific type is named.
- Assume CI variables on unpatched instances were readable. Two independent flaws (92470, 4523) exposed job-trace secrets, one unauthenticated. Rotate CI/CD variables, tokens, and deployment credentials that lived on affected versions.
- Re-audit MCP-scoped tokens and Duo Workflow governance. Scopes were over-broad (92874) and namespace governance bypassable (92529) — verify post-patch that effective permissions match intent, especially for agent service accounts.
- Restrict who can push CI config changes. The 9.9 pair turns a crafted regex in a pipeline definition into server compromise; treat CI YAML write access as a privileged capability, not a developer convenience.
- Watch the 90-day clock. GitLab publishes the underlying issue details 90 days after the patched release — expect working exploit analysis around late December and prioritize internet-facing instances accordingly.
The structural lesson is the pairing: the same release that fixes server takeover via regex also fixes the agent-integration controls that were supposed to bound what authenticated automation can see and do. Patch the parser, then go re-check the scopes — the blast radius of the first depends on the correctness of the second.
Sources: