This Week
Get Alerts ›
cvehawk_ Get Alerts
Software · GitLab

GitLab Vulnerabilities

The latest security flaws in self-managed GitLab, which ones attackers are using, and whether your GitLab version is affected.

New flaws, 30 days
36
Critical, 8 weeks
5
On CISA's exploited list
6
Latest exploited
29 Oct 2026

Go to Help (?) › Help in GitLab, or /help on your instance.

GitLab Security in Short

GitLab publishes security releases twice a month, more often when something is urgent, and fixes only the three newest minor versions. Self-managed instances often hold source code, CI secrets and cloud keys, so a GitLab flaw can open much more than GitLab. Account takeover and CI/CD flaws have been exploited soon after release.

How to Keep GitLab Patched

  • Apply each security release promptly; GitLab marks the critical ones.
  • Stay within the three newest minor versions, or you stop getting fixes.
  • Turn on two-factor authentication for everyone, and limit sign-ups on public instances.
  • GitLab.com is patched by GitLab; this applies to instances you run.

The Past Eight Weeks

Any Score 7+ 8+ 9+

5 flaws scored 9+, newest first.

22 Oct 2026 Memory corruption An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.… CVE-2026-110264 10.0

An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression.

Patch now · NVD Record

13 Oct 2026 Memory corruption GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19… CVE-2026-97229 10.0 Exploited

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.

Patch now · NVD Record

On Hacker News

GitLab Security Incident: Attempted Exploitation of CVE-2026-97229 122 comments
2 Oct 2026 GitLab AI Gateway component affecting all · Remote code execution GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gat… CVE-2026-90970 9.9

GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1 that, under certain conditions, could have allowed an authenticated user with Duo Agent Platform access to escape the prompt template sandbox via a specially crafted flow configuration, resulting in arbitrary command execution on the AI Gateway.

Patch now · NVD Record

24 Sep 2026 Memory corruption GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19… CVE-2026-89078 9.9

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due to a double free issue when parsing a specially crafted regular expression in a CI/CD configuration.

Patch now · NVD Record

24 Sep 2026 Memory corruption GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19… CVE-2026-93577 9.9

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due to an integer overflow issue when compiling a specially crafted regular expression in a CI/CD configuration.

Patch now · NVD Record

Being Exploited

GitLab flaws CISA has added to its list of flaws attackers are using in the past six months, newest first. See all 6 on the KEV page.

Patch now

GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.…

Score 10.0 / 10 · Being exploited · Fixed in 19.2.8, 19.3.5, 19.4.2, 3.3.13

CVE-2026-97229

122 comments on HN

Patch now

GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1…

Score 10.0 / 10 · Being exploited · Fixed in 18.11.12, 19.0.9, 19.1.8, 19.2.6

CVE-2026-85706

On HN

Rather not patch it yourself?

Bobble Solutions patches, backs up and watches Linux servers and WordPress sites.

Talk to Bobble Solutions