GitLab — GitLab Patch Release: 19.2.2, 19.1.4, 19.0.6

Help us learn about your current experience with the documentation. Take the survey.

GitLab Patch Release: 19.2.2, 19.1.4, 19.0.6

On August 12, 2026, we released versions 19.2.2, 19.1.4, 19.0.6 for GitLab Community Edition (CE) and Enterprise Edition (EE). These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action. GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases: scheduled releases and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays. For more information, please visit our releases handbook and security FAQ. You can see all of GitLab release blog posts here. For security fixes, the issues detailing each vulnerability are made public on our issue tracker 90 days after the release in which they were patched. We are committed to ensuring that all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. To maintain good security hygiene, it is highly recommended that all customers upgrade to the latest patch release for their supported version. You can read more best practices in securing your GitLab instance in our blog post.

Recommended Action

We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible. When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, it means all types are affected.

Security fixes

Table of security fixes

TitleSeverity Cross-site Scripting issue in Analytics Dashboards table field configuration impacts GitLab CE/EEHigh Cross-site Scripting issue in Analytics Dashboards pagination controls impacts GitLab CE/EEHigh Remote code execution via path traversal in package registry impacts GitLab CE/EEHigh Improper Authorization issue in CI/CD pipeline API impacts GitLab CE/EEHigh Authorization Bypass issue in Duo Workflow Service impacts GitLab EEHigh Cross-site Scripting issue in CI manual job confirmation modal impacts GitLab CE/EEHigh Missing Authorization issue in ProjectsController impacts GitLab EEHigh Denial of Service issue in GraphQL API JSON parser impacts GitLab CE/EEMedium Missing Authorization issue in merge requests API impacts GitLab EEMedium Missing Authorization issue in external status check API impacts GitLab EEMedium Incorrect Authorization issue in npm dist-tags endpoint impacts GitLab CE/EEMedium Missing Authorization issue in GitLab Duo settings page impacts GitLab EEMedium Incorrect Authorization issue in AI Tool Rules GraphQL resolver impacts GitLab EEMedium Incorrect Privilege Assignment issue in custom roles impacts GitLab EELow

CVE-2026-15217 - Cross-site Scripting issue in Analytics Dashboards table field configuration impacts GitLab CE/EE

GitLab has remediated an issue that under certain conditions could have allowed cross-site scripting due to improper neutralization of user-controlled values rendered in table cell content by an analytics dashboard component. Impacted Versions: GitLab CE/EE: all versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2CVSS 8.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Thanks yvvdwf for reporting this vulnerability through our HackerOne bug bounty program

CVE-2026-15216 - Cross-site Scripting issue in Analytics Dashboards pagination controls impacts GitLab CE/EE

GitLab has remediated an issue that under certain conditions could have allowed cross-site scripting due to improper neutralization of user-controlled data rendered in pagination controls by an analytics dashboard component. Impacted Versions: GitLab CE/EE: all versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2CVSS 8.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Thanks yvvdwf for reporting this vulnerability through our HackerOne bug bounty program

CVE-2026-10053 - Remote code execution via path traversal in package registry impacts GitLab CE/EE

GitLab has remediated an issue that under certain conditions could have allowed an authenticated user to achieve remote code execution due to a path traversal vulnerability in the package registry. Impacted Versions: GitLab CE/EE: all versions from 18.8 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2CVSS 8.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Thanks invisiblemeerkat for reporting this vulnerability through our HackerOne bug bounty program

CVE-2026-15423 - Improper Authorization issue in CI/CD pipeline API impacts GitLab CE/EE

GitLab has remediated an issue that under certain conditions could have allowed an authenticated user with developer-role permissions to execute CI/CD pipelines on a protected branch without the required push permissions due to improper authorization in pipeline reference validation. Impacted Versions: GitLab CE/EE: all versions from 19.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2CVSS 8.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N) Thanks sim4n6 for reporting this vulnerability through our HackerOne bug bounty program

CVE-2026-19228 - Authorization Bypass issue in Duo Workflow Service impacts GitLab EE

GitLab has remediated an issue that under certain conditions could have allowed an authenticated user to cause AI usage to be attributed to another namespace, due to improper authorization of identity information supplied in requests. Impacted Versions: GitLab EE: all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2CVSS 8.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L) This vulnerability was discovered internally by GitLab team member Dennis Appelt

CVE-2026-16627 - Cross-site Scripting issue in CI manual job confirmation modal impacts GitLab CE/EE

GitLab has remediated an issue that under certain conditions could have allowed an authenticated user with developer-role permissions to escalate privileges due to improper sanitization of HTML content rendered in a CI job modal. Impacted Versions: GitLab CE/EE: all versions from 19.2 before 19.2.2CVSS 7.7 (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N) Thanks 3nvz for reporting this vulnerability through our HackerOne bug bounty program

CVE-2026-16494 - Missing Authorization issue in ProjectsController impacts GitLab EE

GitLab has remediated an issue that under certain conditions could have allowed an authenticated user to modify project settings restricted to higher-privileged roles, due to missing authorization checks on a project update endpoint. Impacted Versions: GitLab EE: all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L) Thanks 3nvz for reporting this vulnerability through our HackerOne bug bounty program

CVE-2026-7427 - Denial of Service issue in GraphQL API JSON parser impacts GitLab CE/EE

GitLab has remediated an issue that under certain conditions could have allowed an unauthenticated user to cause a denial of service due to improper input validation. Impacted Versions: GitLab CE/EE: all versions from 18.5 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Thanks aphantom for reporting this vulnerability through our HackerOne bug bounty program

CVE-2026-6821 - Missing Authorization issue in merge requests API impacts GitLab EE

GitLab has remediated an issue that under certain conditions could have allowed an authenticated user to bypass IP-based access restrictions and read limited merge request information from a private project due to missing authorization checks in a merge requests API endpoint. Impacted Versions: GitLab EE: all versions from 12.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Thanks rogerace for reporting this vulnerability through our HackerOne bug bounty program

CVE-2026-4879 - Missing Authorization issue in external status check API impacts GitLab EE

GitLab has remediated an issue that under certain conditions could have allowed an authenticated user with developer-role permissions to view external status check configuration restricted to higher-privileged roles due to missing authorization on a merge request API endpoint. Impacted Versions: GitLab EE: all versions from 16.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Thanks jaykp for reporting this vulnerability through our HackerOne bug bounty program

CVE-2026-8667 - Incorrect Authorization issue in npm dist-tags endpoint impacts GitLab CE/EE

GitLab has remediated an issue that under certain conditions could have allowed an authenticated user with developer role to modify certain package registry metadata without the required maintainer-level permissions due to improper authorization checks. Impacted Versions: GitLab CE/EE: all versions from 17.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Thanks peppersghost for reporting this vulnerability through our HackerOne bug bounty program

CVE-2026-18244 - Missing Authorization issue in GitLab Duo settings page impacts GitLab EE

GitLab has remediated an issue that under certain conditions could have allowed an authenticated user to view restricted configuration settings due to improper authorization checks on a group settings page. Impacted Versions: GitLab EE: all versions from 17.7 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) This vulnerability has been discovered internally by GitLab team member Félix Veillette-Potvin

CVE-2026-18433 - Incorrect Authorization issue in AI Tool Rules GraphQL resolver impacts GitLab EE

GitLab has remediated an issue that under certain conditions could have allowed an authenticated user to read policy configuration belonging to a namespace they were not authorized to access, due to incorrect authorization checks in a GraphQL query. Impacted Versions: GitLab EE: all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Thanks anshuman_bh for reporting this vulnerability through our HackerOne bug bounty program

CVE-2025-9486 - Incorrect Privilege Assignment issue in custom roles impacts GitLab EE

GitLab has remediated an issue that under certain conditions could have allowed a user with a pending membership to receive permissions granted by a custom role, due to incorrect privilege assignment that did not account for membership state. Impacted Versions: GitLab EE: all versions from 15.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2CVSS 3.3 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N) Thanks mateuszek for reporting this vulnerability through our HackerOne bug bounty program

Bug fixes

19.2.2

• Backport of “Gate resolve-dependency-bump button to dependency bot MRs” to 19.2
• Backport of ‘Skip EventWorker enqueue in the Geo Log Cursor when sync_object_storage is disabled on the current node’
• Stop validating web_hook_logs_daily sharding key constraint (19.2 backport)
• Backport: Push agent_artifacts_page flag on project settings edit page
• Backport of ‘Sign Workhorse MCP client requests with the API JWT’
• Backport of ‘Pre-approve Orbit MCP tools in tool_access_policies claim’
• Remove headers within content tabs
• Backport of ‘Pre-approve GitLab MCP server read tools in the token claim’
• Backport Setup Siphon users rake task
• 19.2 Backport of ‘Fix 500 when securityReportFindings cursor is empty string’
• Fix work item drawer Open in full page on issue boards (backport to 19.2) …