Gerrit CVE-2026-2725: Direct Push and SubmitWholeTopic Bypass Vulnerability

Gerrit Vulnerability Summary Vulnerability Overview CVE ID: CVE-2026-2725 Vulnerability Type: Direct Push + Submit Whole Topic Bypass Description: A Gerrit user with direct push privileges who can submit an entire topic can force-merge any change by linking it to a shared topic, bypassing all submission requirements such as code review approval and CI checks. This is a "direct push" vulnerability. Impact Scope Affected Versions: Current versions; likely introduced when topics were first implemented. Data Leakage: No data leakage. Affected Components: REST endpoints. Trigger Conditions: Both direct push and must be enabled. Mitigation: Change the configuration to disable one of these features. Attack Prerequisites The attacker must have an authenticated Gerrit account with push and submit privileges for at least one branch. The attacker must have read-only access to the target (victim) change. The victim must have an open change associated with a topic. The change does not need any approvals and may be in a non-submittable state. The Gerrit server must be configured with . Exploit Impact Allows the attacker to force-merge any change they have access to by linking it to a shared topic. This bypasses all submission requirements, including code review approvals, CI checks, and custom rules, for the target change. The attacker does not need submit privileges for the target change, resulting in unreviewed and unapproved code merges. Remediation Configuration Change: Disable or disable direct push. Privilege Management: Ensure the attacker does not have submit privileges for the target change. Prerequisites 1. Server Configuration: (a common feature used for multi-project coordination). 2. Attacker Privileges: Push + submit privileges on their own branch (standard code review privileges). 3. Attacker Access: Read-only access to the victim's change (standard code review privileges). 4. Attacker Not Required: Submit privileges on their own branch/project.

Goal Reached Thanks to every supporter — we hit 100%!

Gerrit CVE-2026-2725: Direct Push and SubmitWholeTopic Bypass Vulnerability