# GitLab GitLab Patch Release: 19.2.1, 19.1.3, 19.0.5

- Product: GitLab (https://whatsnew.fyi/product/gitlab)
- Vendor: GitLab
- Date: 2026-07-29
- Original notes: https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-1-released/
- Permalink: https://whatsnew.fyi/product/gitlab/releases/2026-07-29-gitlab-patch-release-19.2.1-19.1.3-19.0.5

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

On July 29, 2026, we released versions 19.2.1, 19.1.3, 19.0.5 for GitLab Community Edition (CE) and Enterprise Edition (EE). These versions contain important bug and security fixes, and we strongly re…

- **security** — Fix sensitive information exposure issue in Workhorse where authenticated users with Developer role could access unauthorized information due to insufficient access controls on internal request handling
- **security** — Fix mass assignment issue in Pipeline Schedule API where authenticated users could modify CI/CD configuration belonging to another user due to improper validation of user-supplied attributes
- **security** — Fix denial of service issue in Merge Request Discussions where unauthenticated users could cause denial of service due to insufficient resource throttling when processing merge request discussions
- **security** — Fix race condition issue in merge request approval rules where authenticated users could merge code into a protected branch without required approvals
- **security** — Fix insufficiently protected credentials issue in Virtual Registries where sensitive information could be disclosed to an unintended host due to improper handling of upstream requests
- **security** — Fix improper access control issue in project import status
- **security** — Fix improper authorization issue in project import functionality
- **security** — Fix cross-site scripting issue in paginated views
- **security** — Fix prompt injection issue in Duo Code Review
- **security** — Fix incorrect security token generation issue in Duo Workflows
- **security** — Fix exposure of sensitive information issue in merge request title generation
- **security** — Fix improper access control issue in Pipeline Test Report API
- **security** — Fix incorrect authorization issue in merge request collaboration settings

Help us learn about your current experience with the documentation. Take the survey.
#### GitLab Patch Release: 19.2.1, 19.1.3, 19.0.5
On July 29, 2026, we released versions 19.2.1, 19.1.3, 19.0.5 for GitLab Community Edition (CE) and Enterprise Edition (EE).
These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action.
GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases: scheduled releases and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays. For more information, please visit our releases handbook and security FAQ. You can see all of GitLab release blog posts here.
For security fixes, the issues detailing each vulnerability are made public on our issue tracker 90 days after the release in which they were patched.
We are committed to ensuring that all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. To maintain good security hygiene, it is highly recommended that all customers upgrade to the latest patch release for their supported version. You can read more best practices in securing your GitLab instance in our blog post.
###### Recommended Action
We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible.
When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, it means all types are affected.
##### Security fixes
###### Table of security fixes
TitleSeverity
Sensitive Information Exposure issue in Workhorse impacts GitLab CE/EEHigh
Mass Assignment issue in Pipeline Schedule API impacts GitLab CE/EEHigh
Denial of Service issue in Merge Request Discussions impacts GitLab CE/EEHigh
Race Condition issue in merge request approval rules impacts GitLab EEMedium
Insufficiently Protected Credentials issue in Virtual Registries impacts GitLab EEMedium
Improper Access Control issue in project import status impacts GitLab CE/EEMedium
Improper Authorization issue in project import functionality impacts GitLab CE/EEMedium
Cross-site Scripting issue in paginated views impacts GitLab CE/EEMedium
Prompt Injection issue in Duo Code Review impacts GitLab EEMedium
Incorrect Security Token Generation issue in Duo Workflows impacts GitLab EEMedium
Exposure of Sensitive Information issue in merge request title generation impacts GitLab CE/EEMedium
Improper Access Control issue in Pipeline Test Report API impacts GitLab CE/EEMedium
Incorrect Authorization issue in merge request collaboration settings impacts GitLab CE/EELow
###### CVE-2026-6267 - Sensitive Information Exposure issue in Workhorse impacts GitLab CE/EE
GitLab has remediated an issue that under certain conditions could have allowed an authenticated user with Developer role to access unauthorized information due to insufficient access controls on internal request handling.
Impacted Versions: GitLab CE/EE: all versions from 10.1.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1CVSS 8.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H)
Thanks thwin_htet for reporting this vulnerability through our HackerOne bug bounty program
###### CVE-2026-12436 - Mass Assignment issue in Pipeline Schedule API impacts GitLab CE/EE
GitLab has remediated an issue that under certain conditions could have allowed an authenticated user to modify CI/CD configuration belonging to another user due to improper validation of user-supplied attributes when processing pipeline schedule inputs.
Impacted Versions: GitLab CE/EE: all versions from 18.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1CVSS 8.4 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C

_[Truncated at 4000 characters — full notes: https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-1-released/]_