GitLab Critical Security Update: Upgrade Immediately
GitLab's new patches address serious security vulnerabilities.
1GitLab's Critical Patch Releases Announced
On August 17, 2026, GitLab released versions 19.2.4, 19.1.6, 19.0.8, and 18.11.11. These versions include important bug fixes and security patches. All self-managed GitLab installations are strongly recommended to upgrade to one of these versions as soon as possible. GitLab.com and GitLab Dedicated customers do not need to take any action as these platforms are already running the patched version.
2Scope of Security Vulnerabilities
The patches address an issue that could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQL directive under certain conditions. Affected versions include all releases between 18.2 and 18.11.11, 19.0 and 19.0.8, 19.1 and 19.1.6, and 19.2 and 19.2.4. This vulnerability has a CVSS score of 9.4.
3Second Critical Security Issue
Another significant vulnerability could have allowed unauthenticated users to execute mutations via GET requests due to improper request validation in GraphQL multiplex query handling. This issue affects the same version ranges and has a CVSS score of 7.1. Both vulnerabilities were reported through GitLab's HackerOne bug bounty program.
4Upgrade Process and Recommendations
These versions do not include new migrations and should not require downtime for multi-node deployments. However, Omnibus packages will stop, run migrations, and restart by default. This behavior can be changed by adding a /etc/gitlab/skip-auto-reconfigure file. To update GitLab, visit the Update page, and for GitLab Runner, check the Updating the Runner page.
5Regular Patch Release Policy
GitLab addresses security vulnerabilities in patch releases. There are two types: scheduled releases and ad-hoc critical patches for high-severity issues. Scheduled releases occur twice monthly on the second and fourth Wednesdays. Security fixes become public on the issue tracker 90 days after the release in which they were patched.
6Security Best Practices
GitLab is committed to maintaining the highest security standards for all customer-facing components. To ensure good security hygiene, customers should upgrade to the latest patch release for their supported version. You can read more about securing your GitLab instance in our blog post on best practices.
7Staying Informed
To receive patch blog notifications via email, visit our contact page. For release notifications via RSS, subscribe to our patch release RSS feed or our all-releases RSS feed. These channels will keep you updated on the latest security patches and help you maintain up-to-date systems.
8Take Immediate Action
It's critical to upgrade any installations running affected versions to the latest release immediately. These updates will protect your systems from potential security threats and maintain data integrity. We strongly recommend acting without delay to prevent exploitation of these vulnerabilities.
Original article: GitLab — GitLab'da Kritik Güvenlik Güncellemesi: Hemen Yükseltme Yapın