# GitLab Critical Security Update: Upgrade Immediately

GitLab's new patches address serious security vulnerabilities.

- **Source:** [GitLab](https://brifing.si/source/76101668-80db-4240-8676-e968d2b72546)
- **Published:** 2026-08-17
- **Topic:** [Software & Engineering](https://brifing.si/c/engineering)
- **Original article:** <https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-4-released/>
- **On Brifing:** https://brifing.si/s/0212acf2-dfed-46bd-933e-d5c38c5b9f8c

## GitLab's Critical Patch Releases Announced

On August 17, 2026, GitLab released versions 19.2.4, 19.1.6, 19.0.8, and 18.11.11. These versions include important bug fixes and security patches. All self-managed GitLab installations are strongly recommended to upgrade to one of these versions as soon as possible. GitLab.com and GitLab Dedicated customers do not need to take any action as these platforms are already running the patched version.

## Scope of Security Vulnerabilities

The patches address an issue that could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQL directive under certain conditions. Affected versions include all releases between 18.2 and 18.11.11, 19.0 and 19.0.8, 19.1 and 19.1.6, and 19.2 and 19.2.4. This vulnerability has a CVSS score of 9.4.

## Second Critical Security Issue

Another significant vulnerability could have allowed unauthenticated users to execute mutations via GET requests due to improper request validation in GraphQL multiplex query handling. This issue affects the same version ranges and has a CVSS score of 7.1. Both vulnerabilities were reported through GitLab's HackerOne bug bounty program.

## Upgrade Process and Recommendations

These versions do not include new migrations and should not require downtime for multi-node deployments. However, Omnibus packages will stop, run migrations, and restart by default. This behavior can be changed by adding a /etc/gitlab/skip-auto-reconfigure file. To update GitLab, visit the Update page, and for GitLab Runner, check the Updating the Runner page.

## Regular Patch Release Policy

GitLab addresses security vulnerabilities in patch releases. There are two types: scheduled releases and ad-hoc critical patches for high-severity issues. Scheduled releases occur twice monthly on the second and fourth Wednesdays. Security fixes become public on the issue tracker 90 days after the release in which they were patched.

## Security Best Practices

GitLab is committed to maintaining the highest security standards for all customer-facing components. To ensure good security hygiene, customers should upgrade to the latest patch release for their supported version. You can read more about securing your GitLab instance in our blog post on best practices.

## Staying Informed

To receive patch blog notifications via email, visit our contact page. For release notifications via RSS, subscribe to our patch release RSS feed or our all-releases RSS feed. These channels will keep you updated on the latest security patches and help you maintain up-to-date systems.

## Take Immediate Action

It's critical to upgrade any installations running affected versions to the latest release immediately. These updates will protect your systems from potential security threats and maintain data integrity. We strongly recommend acting without delay to prevent exploitation of these vulnerabilities.

## Sources covering this story

- https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-4-released/ — 

---

_Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._