GitLab Vulnerabilities: Latest CVEs and Version Check

GitLab Security in Short

GitLab publishes security releases twice a month, more often when something is urgent, and fixes only the three newest minor versions. Self-managed instances often hold source code, CI secrets and cloud keys, so a GitLab flaw can open much more than GitLab. Account takeover and CI/CD flaws have been exploited soon after release.

How to Keep GitLab Patched

Apply each security release promptly; GitLab marks the critical ones.
Stay within the three newest minor versions, or you stop getting fixes.
Turn on two-factor authentication for everyone, and limit sign-ups on public instances.
GitLab.com is patched by GitLab; this applies to instances you run.

The Past Eight Weeks

10 flaws scored 8+, newest first.

22 Oct 2026 Memory corruption An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.… CVE-2026-110264 10.0

An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression.

Patch now · NVD Record

22 Oct 2026 Security flaw GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1 before 19.3.6, 19.4 before 19… CVE-2026-15723 8.2

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when OmniAuth SAML and LDAP auto-linking were both enabled, an authenticated user could have taken over an existing LDAP-backed account without any interaction from the targeted user, due to improper input sanitization in the LDAP email lookup path used during OmniAuth identity linking.

Patch this week · NVD Record

13 Oct 2026 Memory corruption GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19… CVE-2026-97229 10.0 Exploited

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.

Patch now · NVD Record

On Hacker News

GitLab Security Incident: Attempted Exploitation of CVE-2026-97229 122 comments

13 Oct 2026 Cross-site scripting GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19… CVE-2026-92883 8.7

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to execute arbitrary JavaScript in the context of other users' browser sessions via a specially crafted repository, due to improper sanitization of HTML attributes in syntax-highlighted output.

Patch this week · NVD Record

13 Oct 2026 Access control flaw GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.2.8, 19.3 before 19… CVE-2026-16301 8.5

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with Developer role to execute CI/CD pipelines on protected branches without authorization due to improper authorization checks in the downstream pipeline creation service.

Patch this week · NVD Record

13 Oct 2026 Security flaw GitLab has remediated an issue in GitLab CE/EE affecting all versions before 19.2.8, 19.3 before 19.3.5, and … CVE-2026-14814 8.2

GitLab has remediated an issue in GitLab CE/EE affecting all versions before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed a user to poison cached responses for raw repository files, causing targeted users' CI/CD pipelines to execute specially crafted content and potentially exposing protected environment variables, due to improper validation of repository references.

Patch this week · NVD Record

2 Oct 2026 GitLab AI Gateway component affecting all · Remote code execution GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gat… CVE-2026-90970 9.9

GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1 that, under certain conditions, could have allowed an authenticated user with Duo Agent Platform access to escape the prompt template sandbox via a specially crafted flow configuration, resulting in arbitrary command execution on the AI Gateway.

Patch now · NVD Record

29 Sep 2026 Cross-site scripting GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11 before 19.2.7, 19.3 before 1… CVE-2026-84739 8.7

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary JavaScript in the context of another user's browser session due to improper sanitization of path components in the merge request diff viewer.

Patch this week · NVD Record

24 Sep 2026 Memory corruption GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19… CVE-2026-89078 9.9

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due to a double free issue when parsing a specially crafted regular expression in a CI/CD configuration.

Patch now · NVD Record

24 Sep 2026 Memory corruption GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19… CVE-2026-93577 9.9

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due to an integer overflow issue when compiling a specially crafted regular expression in a CI/CD configuration.

Patch now · NVD Record

Being Exploited

GitLab flaws CISA has added to its list of flaws attackers are using in the past six months, newest first. See all 6 on the KEV page.

Patch now

GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.…

Score 10.0 / 10 · Being exploited · Fixed in 19.2.8, 19.3.5, 19.4.2, 3.3.13

CVE-2026-97229

122 comments on HN

Patch now

GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1…

Score 10.0 / 10 · Being exploited · Fixed in 18.11.12, 19.0.9, 19.1.8, 19.2.6

CVE-2026-85706

On HN