# GitLab GitLab Patch Release: 19.3.1, 19.2.5, 19.1.7

- Product: GitLab (https://whatsnew.fyi/product/gitlab)
- Vendor: GitLab
- Date: 2026-08-26
- Original notes: https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-1-released/
- Permalink: https://whatsnew.fyi/product/gitlab/releases/2026-08-26-gitlab-patch-release-19.3.1-19.2.5-19.1.7

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

On August 26, 2026, we released versions 19.3.1, 19.2.5, 19.1.7 for GitLab Community Edition (CE) and Enterprise Edition (EE). These versions contain important bug and security fixes, and we strongly…

- **security** — Remediate inclusion of functionality from untrusted control sphere issue in Duo Claude AI agent that allowed authenticated users with developer-role permissions to execute arbitrary commands in a CI context (CVE-2026-18252)
- **security** — Remediate denial of service issue in import pipeline caused by missing object count limits that allowed authenticated users to cause denial of service affecting background job processing (CVE-2026-77801)
- **security** — Remediate denial of service issue in SCIM API caused by unbounded loop triggered by specially crafted input in SCIM user provisioning feature (CVE-2025-10903)
- **security** — Remediate improper access control issue in protected environments that allowed authenticated users with project Maintainer permissions to access protected environment terminals they were not authorized to use (CVE-2026-3035)
- **security** — Remediate authorization bypass issue in compliance framework assignment that allowed authenticated users to assign compliance frameworks from unauthorized namespaces to their own project (CVE-2026-4398)
- **security** — Remediate improper handling of untrusted data issue in Pipeline Execution Policies that allowed authenticated users with developer-role permissions to influence execution environment of Pipeline Execution Policy enforcement jobs (CVE-2026-15387)
- **security** — Remediate improper authorization issue in merge request approval rules reset

Help us learn about your current experience with the documentation. Take the survey.
#### GitLab Patch Release: 19.3.1, 19.2.5, 19.1.7
On August 26, 2026, we released versions 19.3.1, 19.2.5, 19.1.7 for GitLab Community Edition (CE) and Enterprise Edition (EE).
These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action.
GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases: scheduled releases and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays. For more information, please visit our releases handbook and security FAQ. You can see all of GitLab release blog posts here.
For security fixes, the issues detailing each vulnerability are made public on our issue tracker 90 days after the release in which they were patched.
We are committed to ensuring that all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. To maintain good security hygiene, it is highly recommended that all customers upgrade to the latest patch release for their supported version. You can read more best practices in securing your GitLab instance in our blog post.
###### Recommended Action
We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible.
When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, it means all types are affected.
##### Security fixes
###### Table of security fixes
TitleSeverity
Inclusion of Functionality from Untrusted Control Sphere issue in Duo Claude AI agent impacts GitLab EEHigh
Denial of Service issue in import pipeline impacts GitLab CE/EEMedium
Denial of Service issue in SCIM API impacts GitLab EEMedium
Improper Access Control issue in protected environments impacts GitLab EEMedium
Authorization Bypass issue in compliance framework assignment impacts GitLab EEMedium
Improper Handling of Untrusted Data issue in Pipeline Execution Policies impacts GitLab EEMedium
Improper Authorization issue in merge request approval rules reset impacts GitLab EELow
###### CVE-2026-18252 - Inclusion of Functionality from Untrusted Control Sphere issue in Duo Claude AI agent impacts GitLab EE
GitLab has remediated an issue that, under certain conditions, an authenticated user with developer-role permissions could have executed arbitrary commands in a CI context, due to the Claude agent processing configuration from a user-controlled source.
Impacted Versions: GitLab EE: all versions from 18.9 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1CVSS 7.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N)
Thanks thwin_htet for reporting this vulnerability through our HackerOne bug bounty program
###### CVE-2026-77801 - Denial of Service issue in import pipeline impacts GitLab CE/EE
GitLab has remediated an issue that, under certain conditions, an authenticated user could have caused denial of service affecting background job processing, due to missing object count limits.
Impacted Versions: GitLab CE/EE: all versions from 12.8 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Thanks Tran Ba Quang for reporting this vulnerability
###### CVE-2025-10903 - Denial of Service issue in SCIM API impacts GitLab EE
GitLab has remediated an issue that, under certain conditions, an authenticated user could have caused denial of service, due to an unbounded loop triggered by specially crafted input in the SCIM user provisioning feature.
Impacted Versions: GitLab EE: all versions from 11.10 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1

_[Truncated at 4000 characters — full notes: https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-1-released/]_