Critical Security Updates Released for GitLab
Emergency patches address 8 different security vulnerabilities
1Security Vulnerabilities Requiring Immediate Update
On July 29, 2026, GitLab released versions 19.2.1, 19.1.3, and 19.0.5 to patch 8 critical security vulnerabilities. These flaws, with CVSS scores ranging from 4.3 to 8.5, could allow unauthorized access to sensitive information, particularly targeting Developer and Maintainer roles. While GitLab.com is already running the patched version, self-managed installations must update immediately to mitigate these risks.
2Most Critical Vulnerability: Unauthorized Access
The most severe vulnerability (CVSS 8.5) allowed Developer role users to access unauthorized information under certain conditions. Affecting all versions from 10.1.0 through pre-19.0.5, this flaw stemmed from insufficient access controls in internal request handling. Reported by thwin_htet via HackerOne, GitLab has strengthened its access control mechanisms to resolve this issue.
3CI/CD Configuration Security Flaw
Another critical vulnerability (CVSS 8.4) enabled users to modify other users' CI/CD configurations due to improper validation of pipeline schedule inputs. Affecting all versions from 18.0 onward, this issue was reported by a0xnirudh. GitLab has implemented improved input validation processes to prevent such unauthorized modifications in future releases.
4Denial of Service Vulnerability
A 7.5 CVSS-rated vulnerability could allow unauthenticated users to cause service disruptions when processing merge request discussions. Affecting versions from 11.8 onward, this flaw was discovered internally by GitLab team member Hordur Freyr Yngvason. The platform has enhanced its resource throttling mechanisms to prevent potential DoS attacks.
5Unauthorized Protected Branch Merges
A race condition in approval rule processing (CVSS 6.5) allowed users to merge code into protected branches without required approvals. Exclusive to Enterprise Edition and affecting versions from 17.0, this was discovered by GitLab's Niklas Janz. The fix involves improved handling of approval workflows to eliminate race conditions.
6Information Disclosure in Virtual Registries
With a CVSS score of 5.4, this vulnerability could leak sensitive data to unintended hosts due to improper upstream request handling in virtual registries. Affecting EE versions from 18.8, it was found internally by Fiona McCawley. GitLab has revised its virtual registry processing logic to prevent such leaks.
7Project Import Source Visibility
Missing authorization checks (CVSS 5.3) allowed unauthorized viewing of project import sources in versions from 16.6. Reported by 3nvz via HackerOne, GitLab has added proper authorization controls to relevant API endpoints. This prevents potential exposure of sensitive import configuration details.
8GitLab's Security Approach and Next Steps
These patches follow GitLab's scheduled twice-monthly release cycle. Vulnerability details become public 90 days after patch release. Users should upgrade to the latest supported version and follow security best practices. GitLab continues to lead in rapid vulnerability resolution and transparent disclosure processes within the DevOps security landscape.
Original article: GitLab — GitLab'da Kritik Güvenlik Güncellemeleri Yayınlandı