GitLab Releases Critical Security Patches for Multiple Vulnerabilities
Critical security updates address 9 vulnerabilities with CVSS scores up to 10.0
1Critical Patch Release
GitLab has released emergency patches (versions 19.3.2, 19.2.6, 19.1.8) addressing nine critical vulnerabilities affecting both Community and Enterprise editions. The most severe vulnerability carries a CVSS score of 10.0, indicating maximum severity. These patches cover security flaws that could lead to remote code execution, data breaches, and denial of service attacks. GitLab.com is already protected, but self-managed instances require immediate manual updates.
2File Read Vulnerability (CVSS 10.0)
The most critical vulnerability (CVE-2026-XXXXX) allows unauthenticated attackers to read arbitrary files from GitLab servers due to improper path confinement in the repository commits API. Affects all versions from 18.7 through 19.3.1. This flaw could expose sensitive configuration files, source code, or credentials stored on the server. The vulnerability was reported through GitLab's HackerOne bug bounty program by researcher s3ntago.
3Credential Exposure via GraphQL
Another high-severity issue (CVSS 9.9) enables authenticated users with Duo Chat access to extract Advanced Search configurations and credentials through crafted GraphQL subscriptions. Affects Enterprise Edition versions from 18.3 onward. The vulnerability bypasses serialization protections, potentially exposing database credentials and search configurations. Researcher kyyblin discovered and reported this flaw.
4Remote Code Execution Risk
A buffer overflow vulnerability (CVSS 8.5) in Advanced Search indexing could allow authenticated attackers to execute arbitrary code by importing malicious Git project exports. Impacts Enterprise Edition versions as old as 12.3. The Unicode conversion buffer overflow could give attackers full server control. Researcher joaxcar identified this critical security hole.
5CI/CD Variable Exposure
Two separate vulnerabilities (both CVSS 8.5) allow unauthorized access to protected CI/CD variables. One flaw lets developers access variables restricted to higher-privileged roles, while another bypasses environment scope restrictions. These could expose deployment credentials, API keys, and other sensitive automation secrets. Researcher yvvdwf reported the privilege escalation issue.
6Markdown Renderer Vulnerability
An improper sanitization flaw (CVSS 8.2) in the Markdown JSON table renderer could enable CSRF attacks, tricking users into performing unintended actions. Affects versions from 15.3 onward. This client-side vulnerability requires user interaction but could lead to account takeover or data modification. Researcher a_m_a_m discovered this security weakness.
7Denial of Service Risks
Two separate GraphQL vulnerabilities (both CVSS 7.5) could allow unauthenticated attackers to crash GitLab instances through resource exhaustion. These flaws in complexity calculation logic affect versions from 18.4.6. While not enabling data theft, these DoS vulnerabilities could disrupt development workflows and CI/CD pipelines. Researchers hunter0xp7 and joaxcar reported these issues.
8Update Recommendations
GitLab strongly recommends immediate upgrades for all affected self-managed installations. The company follows a twice-monthly patch schedule but releases ad-hoc updates for critical vulnerabilities. Administrators should prioritize updates during maintenance windows, testing in staging environments first. GitLab provides detailed upgrade documentation and security best practices for hardening instances against attacks.
9Security Disclosure Policy
GitLab maintains a responsible disclosure process through its HackerOne program, publicly detailing vulnerabilities 90 days after patching. The company has awarded bounties to all researchers who discovered these flaws. This transparent approach helps the broader community understand security risks while giving organizations time to patch before detailed exploit information becomes public.
Original article: GitLab — GitLab Releases Critical Security Patches for Multiple Vulnerabilities