GitLab Releases Critical Security Patch for 19.3, 19.2 and 19.1

GitLab has released versions 19.3.2, 19.2.6 and 19.1.8 for GitLab Community Edition (CE) and Enterprise Edition (EE), addressing important bug and security issues across the platform.

The company strongly recommends that all affected self-managed GitLab installations upgrade to one of the patched versions immediately.

GitLab.com is already running the patched version, while GitLab Dedicated customers do not need to take action.

The September 10 patch release includes 18 security fixes, covering vulnerabilities rated Critical, High, Medium and Low severity. The issues affect areas including repository APIs, GraphQL, Advanced Search, CI/CD variables, authentication, protected environments, package management and the Terraform State API.

18 Security Issues Across Four Severity Levels

The security fixes consist of:

• 2 Critical

• 6 High

• 9 Medium

• 1 Low

The two Critical vulnerabilities are particularly significant because they involve arbitrary file access and insecure deserialization, while the High-severity issues include remote code execution, protected CI/CD variable access, cross-site scripting, authorization problems and denial-of-service conditions.

Two Critical Vulnerabilities

CVE-2026-85706: Path Traversal in Repository Commits API

The most severe issue addressed in the release is CVE-2026-85706, a path traversal vulnerability affecting GitLab CE and EE.

Under certain conditions, an unauthenticated user could have read arbitrary files from the GitLab server because of improper path confinement and missing authentication enforcement in the repository commits API.

The vulnerability carries a CVSS score of 10.0.

Affected versions include GitLab CE/EE versions from 18.7 before 19.1.8, 19.2 before 19.2.6 and 19.3 before 19.3.2.

GitLab credited s3ntago for reporting the vulnerability through its HackerOne bug bounty program.

CVE-2026-87719: Insecure Deserialization in GraphQL

The second Critical issue, CVE-2026-87719, affects GitLab Enterprise Edition.

Under certain conditions, an authenticated user with Duo Chat access could obtain Advanced Search instance configurations and sensitive credentials by using a specially crafted GraphQL subscription argument to bypass serialization and perform server object lookup.

The vulnerability has a CVSS score of 9.9.

Affected GitLab EE versions include versions from 18.3 before 19.1.8, 19.2 before 19.2.6 and 19.3 before 19.3.2.

GitLab credited kyyblin for reporting the issue through the HackerOne bug bounty program.

Six High-Severity Vulnerabilities

GitLab's patch also addresses six High-severity issues.

CVE-2026-88765 involves a buffer overflow in the Unicode conversion wrapper in GitLab EE. Under certain conditions, an authenticated user could achieve remote code execution by importing a specially crafted Git project export that overflows the Unicode conversion buffer used in Advanced Search indexing. The issue has a CVSS score of 8.5.

CVE-2026-79708 affects the Scheduled Pipeline Execution Policy test in GitLab EE. Under certain conditions, an authenticated user with Developer permissions could execute a policy test pipeline on projects within their group and access protected CI/CD variables restricted to higher-privileged roles. The vulnerability has a CVSS score of 8.5.

CVE-2026-78252 is a cross-site scripting issue in the Markdown JSON table renderer affecting GitLab CE/EE. Under certain conditions, an authenticated user could induce a targeted user to perform unintended state-changing HTTP requests because of improper sanitization of user-controlled data. It has a CVSS score of 8.2.

CVE-2026-13210 concerns incorrect authorization in the CI/CD environment variable scope matcher in GitLab CE/EE. Under certain conditions, an authenticated user could access CI/CD variables outside their intended environment scope because of improper input validation. The issue has a CVSS score of 7.7.

Two additional High-severity issues, CVE-2025-14871 and CVE-2026-1168, involve denial-of-service conditions in the GraphQL complexity limiter. Under certain conditions, an unauthenticated user could cause denial of service because of improper resource allocation limits in GraphQL complexity calculation logic. Both vulnerabilities carry a CVSS score of 7.5.

Medium- and Low-Severity Issues

The release also addresses nine Medium-severity vulnerabilities and one Low-severity issue.

The Medium-severity fixes include:

• CVE-2024-11222: Race condition in Merge Request Pipelines that could allow a Developer user, under certain conditions, to perform actions in the context of another user's merge request commit. CVSS 6.4.

• CVE-2026-12910: Improper authentication in SAML SSO sign-in restriction enforcement that could allow an authenticated user to bypass SAML SSO restrictions under certain conditions. CVSS 5.4.

• CVE-2026-82837: Insufficiently protected credentials in Workhorse senddata emitters, potentially allowing access to sensitive credentials and tokens under certain conditions. CVSS 5.3.

• CVE-2026-19619: Cross-site scripting in the Content Editor that could allow an unauthenticated user to execute arbitrary JavaScript in a targeted user's session under certain conditions. CVSS 4.7.

• CVE-2026-86341: An access control implementation issue in protected environment approval rules that could allow an Owner or Maintainer to silently disable deployment approval requirements under certain conditions. CVSS 4.4.

• CVE-2026-86340: An authorization bypass in protected environment approval rules that could allow required deployment approvals to be bypassed by deleting the sole approver group or user account. CVSS 4.4.

• CVE-2026-7514: Missing authorization in the Generic Package Registry that could allow an authenticated Developer-level user to substitute package file content and hide packages from their owners. CVSS 4.3.

• CVE-2026-8030: Improper input validation in Namespace Transfer that could allow an authenticated user to prevent another user from modifying group settings under certain conditions. CVSS 4.3.

• CVE-2026-16794: Missing authorization in Compliance Framework management that could allow an authenticated Security Manager to execute arbitrary CI/CD jobs and access protected variables within group projects under certain conditions. CVSS 4.3.

The Low-severity issue, CVE-2026-3855, affects the Terraform State API in GitLab CE/EE. Under certain conditions, an authenticated user with project-level permissions could access restricted file contents on the server or cause denial of service because of improper validation of parameters in Terraform state upload functionality. The issue has a CVSS score of 3.1.

Additional Bug Fixes and Dependency Updates

Beyond the security fixes, GitLab 19.3.2, 19.2.6 and 19.1.8 include a range of bug fixes, backports and dependency updates.

For GitLab 19.3.2, the release updates Ruby from 3.3.11 to 3.3.12 and Go to 1.26.7. It also updates websocket-driver to 0.8.2, NGINX to 1.31.4, Redis to 7.2.16, PostgreSQL to 17.11 and Consul to 1.22.7.

The 19.3.2 release also contains multiple backported fixes, including changes involving Git patch IDs, HTTP connections, Geo functionality, CI pipeline lookups, Bitbucket Cloud API-token imports and other GitLab components.

For 19.2.6, GitLab updates Go to 1.26.7, websocket-driver to 0.8.2, NGINX to 1.31.4, Redis to 7.2.16, PostgreSQL to 17.11 and Consul to 1.22.7. The release also includes multiple backported fixes.

For 19.1.8, GitLab updates Go to 1.25.14, websocket-driver to 0.8.2, NGINX to 1.31.4, Redis to 7.2.16, PostgreSQL to 17.11 and Consul to 1.22.7.

Upgrade Considerations for Self-Managed Installations

GitLab says the patch includes database migrations that may affect the upgrade process.

For single-node installations, the patch will cause downtime during the upgrade because the migrations must complete before GitLab can start.

Multi-node installations can apply the patch without downtime when proper zero-downtime upgrade procedures are followed.

GitLab also notes that 19.3.2 includes post-deploy migrations, which can run after the upgrade.

Administrators should therefore review the appropriate GitLab upgrade guidance before applying the patch, particularly when operating single-node or multi-node deployments.

GitLab Urges Immediate Updates

GitLab's primary recommendation is straightforward: affected self-managed installations should be upgraded to the latest patch version as soon as possible.

The company releases security fixes through patch releases, which include both scheduled releases and ad-hoc critical patches for high-severity vulnerabilities. Scheduled patch releases are issued twice a month, on the second and fourth Wednesdays.

GitLab also states that security issues detailing individual vulnerabilities are made public on its issue tracker 90 days after the release in which they were patched.

For organizations managing GitLab themselves, the September 10 release therefore represents an important maintenance update, particularly for installations running affected versions.

The company did not provide specific information about exploitation activity related to these vulnerabilities in the announcement.

What Enterprises Should Know

The announcement highlights the importance of keeping self-managed software platforms on supported patch releases, particularly when vulnerabilities affect areas such as authentication, authorization, CI/CD variables, repository APIs and server-side processing.

For enterprises operating GitLab infrastructure internally, the immediate operational consideration is to identify affected installations and plan the appropriate upgrade procedure.

Single-node environments should account for upgrade downtime, while multi-node deployments should follow GitLab's documented zero-downtime procedures where applicable.

The release also demonstrates that security patches can include both vulnerability remediation and broader bug fixes and dependency updates. Organizations should therefore treat the update as a platform maintenance release rather than focusing only on the two Critical vulnerabilities.

Conclusion

GitLab's September 10, 2026 patch release delivers 18 security fixes across versions 19.3.2, 19.2.6 and 19.1.8, including two Critical vulnerabilities rated CVSS 10.0 and 9.9.

The fixes cover GitLab CE and EE components and address issues involving path traversal, insecure deserialization, buffer overflow, CI/CD variables, cross-site scripting, authorization, authentication, denial of service and other security controls.

GitLab strongly recommends that affected self-managed installations upgrade immediately. Administrators should also account for the database migrations included in the patch and the different upgrade considerations for single-node and multi-node deployments.

For GitLab.com customers, the company says the patched version is already running. GitLab Dedicated customers do not need to take action.