GitLab — GitLab Patch Release: 19.2.1, 19.1.3, 19.0.5

Help us learn about your current experience with the documentation. Take the survey.

GitLab Patch Release: 19.2.1, 19.1.3, 19.0.5

On July 29, 2026, we released versions 19.2.1, 19.1.3, 19.0.5 for GitLab Community Edition (CE) and Enterprise Edition (EE). These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action. GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases: scheduled releases and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays. For more information, please visit our releases handbook and security FAQ. You can see all of GitLab release blog posts here. For security fixes, the issues detailing each vulnerability are made public on our issue tracker 90 days after the release in which they were patched. We are committed to ensuring that all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. To maintain good security hygiene, it is highly recommended that all customers upgrade to the latest patch release for their supported version. You can read more best practices in securing your GitLab instance in our blog post.

Recommended Action

We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible. When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, it means all types are affected.

Security fixes

Table of security fixes

TitleSeverity Sensitive Information Exposure issue in Workhorse impacts GitLab CE/EEHigh Mass Assignment issue in Pipeline Schedule API impacts GitLab CE/EEHigh Denial of Service issue in Merge Request Discussions impacts GitLab CE/EEHigh Race Condition issue in merge request approval rules impacts GitLab EEMedium Insufficiently Protected Credentials issue in Virtual Registries impacts GitLab EEMedium Improper Access Control issue in project import status impacts GitLab CE/EEMedium Improper Authorization issue in project import functionality impacts GitLab CE/EEMedium Cross-site Scripting issue in paginated views impacts GitLab CE/EEMedium Prompt Injection issue in Duo Code Review impacts GitLab EEMedium Incorrect Security Token Generation issue in Duo Workflows impacts GitLab EEMedium Exposure of Sensitive Information issue in merge request title generation impacts GitLab CE/EEMedium Improper Access Control issue in Pipeline Test Report API impacts GitLab CE/EEMedium Incorrect Authorization issue in merge request collaboration settings impacts GitLab CE/EELow

CVE-2026-6267 - Sensitive Information Exposure issue in Workhorse impacts GitLab CE/EE

GitLab has remediated an issue that under certain conditions could have allowed an authenticated user with Developer role to access unauthorized information due to insufficient access controls on internal request handling. Impacted Versions: GitLab CE/EE: all versions from 10.1.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1CVSS 8.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Thanks thwin_htet for reporting this vulnerability through our HackerOne bug bounty program

CVE-2026-12436 - Mass Assignment issue in Pipeline Schedule API impacts GitLab CE/EE

GitLab has remediated an issue that under certain conditions could have allowed an authenticated user to modify CI/CD configuration belonging to another user due to improper validation of user-supplied attributes when processing pipeline schedule inputs. Impacted Versions: GitLab CE/EE: all versions from 18.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1CVSS 8.4 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L) Thanks a0xnirudh for reporting this vulnerability through our HackerOne bug bounty program

CVE-2026-15975 - Denial of Service issue in Merge Request Discussions impacts GitLab CE/EE

GitLab has remediated an issue that under certain conditions could have allowed an unauthenticated user to cause a denial of service due to insufficient resource throttling when processing merge request discussions. Impacted Versions: GitLab CE/EE: all versions from 11.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) This vulnerability has been discovered internally by GitLab team member Hordur Freyr Yngvason

CVE-2026-13113 - Race Condition issue in merge request approval rules impacts GitLab EE

GitLab has remediated an issue that under certain conditions could have allowed an authenticated user to merge code into a protected branch without the required approvals due to a race condition in approval rule processing. Impacted Versions: GitLab EE: all versions from 17.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) This vulnerability has been discovered internally by GitLab team member Niklas Janz

CVE-2026-16553 - Insufficiently Protected Credentials issue in Virtual Registries impacts GitLab EE

GitLab has remediated an issue that under certain conditions could have allowed some sensitive information to be disclosed to an unintended host due to improper handling of upstream requests in virtual registries. Impacted Versions: GitLab EE: all versions from 18.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1CVSS 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L) This vulnerability has been discovered internally by GitLab team member Fiona McCawley

CVE-2026-6336 - Improper Access Control issue in project import status impacts GitLab CE/EE

GitLab has remediated an issue that under certain conditions could have allowed an unauthorized user to view project import source information due to a missing authorization check. Impacted Versions: GitLab CE/EE: all versions from 16.6 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Thanks 3nvz for reporting this vulnerability through our HackerOne bug bounty program

CVE-2026-14341 - Improper Authorization issue in project import functionality impacts GitLab CE/EE

GitLab has remediated an issue that under certain conditions could have allowed an authenticated user with Maintainer role to modify protected branch configuration due to improper authorization in a projects API endpoint. Impacted Versions: GitLab CE/EE: all versions from 12.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1CVSS 4.9 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N) Thanks slide123 for reporting this vulnerability through our HackerOne bug bounty program

CVE-2026-3093 - Cross-site Scripting issue in paginated views impacts GitLab CE/EE

GitLab has remediated an issue that under certain conditions could have allowed an attacker to execute arbitrary JavaScript in another user’s browser via a crafted URL, due to improper sanitization of user-controlled input. Impacted Versions: GitLab CE/EE: all versions from 14.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1CVSS 4.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N) Thanks go7f0 for reporting this vulnerability through our HackerOne bug bounty program

CVE-2026-15077 - Prompt Injection issue in Duo Code Review impacts GitLab EE

GitLab has remediated an issue that under certain conditions could have allowed an authenticated user to access information from unauthorized projects due to improper neutralization of untrusted content processed by the AI-assisted code review functionality. Impacted Versions: GitLab EE: all versions from 19.1 before 19.1.3 and 19.2 before 19.2.1CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) This vulnerability has been discovered internally by GitLab team member Mike Wronski

CVE-2026-15831 - Incorrect Security Token Generation issue in Duo Workflows impacts GitLab EE

GitLab has remediated an issue that under certain conditions could have allowed an authenticated user to bypass administrator-configured tool governance policies due to improper authorization enforcement during token generation. Impacted Versions: GitLab EE: all versions from 19.1 before 19.1.3 and 19.2 before 19.2.1CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) This vulnerability has been discovered internally by GitLab team member Dennis Appelt

CVE-2026-14351 - Exposure of Sensitive Information issue in merge request title generation impacts GitLab CE/EE

GitLab has remediated an issue that under certain conditions could have allowed an unauthenticated user to view the title of a confidential issue through a publicly accessible merge request due to improper authorization checks. Impacted Versions: GitLab CE/EE: all versions from 8.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Thanks toofikz for reporting this vulnerability through our HackerOne bug bounty program

CVE-2026-4672 - Improper Access Control issue in Pipeline Test Report API impacts GitLab CE/EE

GitLab has remediated an issue that under certain conditions could have allowed an authenticated user with guest-role permissions to access test report contents they were not authorized to view due to improper access control enforcement. Impacted Versions: GitLab CE/EE: all versions from 18.4 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Thanks rogerace for reporting this vulnerability through our HackerOne bug bounty program

CVE-2025-14562 - Incorrect Authorization issue in merge request collaboration settings impacts GitLab CE/EE

GitLab has remediated an issue that under certain conditions could have allowed an authenticated user with developer-role permissions to commit changes to a project after being removed as a member, due to improper authorization checks on merge request collaboration settings. Impacted Versions: GitLab CE/EE: all versions from 10.6 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1CVSS 3.1 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N) Thanks theluci for reporting this vulnerability through our HackerOne bug bounty program

Bug fixes

19.2.1

• Backport final 19.2 release notes
• [19.2] Backport of “Remove –unlink-first and –recursive-unlink from tar extract”
• [19.2] Backport of Revert “Merge branch ‘jmd/fix-merge-request-reapprove-reunapprove’ into ‘master’”
• Backport “Enforce admin Duo lock on group settings update” to 19.2
• Backport of ‘Fix keys.organization_id NOT NULL constraint failure on Self-Managed/Dedicated upgrades’ to 19.2
• 19.2 backport of feat(danger): Block post-deploy migrations on security MRs
• [19.2] Delete orphaned caches in helm metadata cache backfill
• Backport ‘Restore AI infrastructure settings after 19.2 upgrades’ to 19-2-stable-ee
• Backport of ‘Fix HTTP_V2 config leak breaking unrelated specs’
• Backport of “Fix self-hosted DWS TLS setting ignored in flow validation and metadata”
• Backport of ‘Fix self-managed admin/owner cannot enroll namespaces into Orbit’
• Backport of ‘Enable Orbit and Knowledge Graph feature flags by default’
• Backport of Fix silent data loss in Advanced Search routing for >128 root_ancestor_ids

19.1.3

• Update gitlab-logger to v4.0.1 (19-1-stable)
• Backport of “Allow AIGW timeout setting on GitLab Dedicated instances”
• Backport of “Fixes the Copy commit SHA button in commits list”
• Backport of ‘Keep virtual registry settings toggle visible when disabled’ into 19.1
• Merge branch ‘ss/revert-cb7f0fd33375’ into ‘master’
• Backport of “Fix blob preview diff hiding blank added lines”
• Fix nil error when checking checkpoints that are not fully instantiated (19-1 backport) …