GitLab: 12 Vulnerabilities Disclosed Together, Including Critical RCE and Auth Bypass Flaws
GitLab Inc. disclosed 12 vulnerabilities on September 16, 2026, including critical flaws enabling RCE and unauthorized access, necessitating urgent updates for self-managed instances.
Key findings
- A batch of 12 CVEs was disclosed for GitLab CE/EE on September 16, 2026.
- High-severity flaws include RCE (CVE-2026-88765), policy execution bypass (CVE-2026-79708), and unauthorized HTTP requests (CVE-2026-78252).
- Unauthenticated DoS vulnerabilities (CVE-2026-1168, CVE-2025-14871) were also patched.
- Patches are available in GitLab versions 19.3.2, 19.2.6, and 19.1.8.
- Self-managed GitLab instances are strongly urged to update immediately.
On September 16, 2026, GitLab disclosed a batch of 12 vulnerabilities affecting both its Community Edition (CE) and Enterprise Edition (EE). These vulnerabilities, disclosed within a 14-hour window, range in severity from low to high, with several critical flaws carrying a CVSSv3 score of 8.5. The disclosures highlight potential risks including remote code execution, arbitrary file reads, and denial of service conditions, underscoring the need for immediate patching by self-managed customers.
Several high-severity vulnerabilities were addressed in this batch. CVE-2026-88765, a critical RCE flaw, allows authenticated users to execute arbitrary code by importing a specially crafted Git project export, exploiting a Unicode conversion buffer overflow. Another critical vulnerability, CVE-2026-79708 (CVSSv3 8.5), enables authenticated users with developer permissions to execute policy test pipelines and access protected data. Additionally, CVE-2026-78252 (CVSSv3 8.2) could allow authenticated users to perform unintended state-changing HTTP requests due to improper sanitization of user-controlled input.
Other notable vulnerabilities include CVE-2026-1168 and CVE-2025-14871, both unauthenticated denial-of-service flaws stemming from improper resource allocation limits in GraphQL complexity calculations. CVE-2026-19619 (CVSSv3 4.7) presents a cross-site scripting (XSS) risk, allowing unauthenticated users to execute arbitrary JavaScript in a targeted user's session. Furthermore, CVE-2026-13210 (CVSSv3 7.7) permits authenticated users to access CI/CD variables outside their intended scope due to improper input validation.
The batch also includes medium-severity issues such as CVE-2026-86341, where authenticated users with Owner or Maintainer permissions could disable protected environment deployment approvals. CVE-2026-7514 and CVE-2026-16794, both with CVSSv3 4.3, involve improper authorization checks allowing developers to hide packages and security managers to execute unauthorized CI/CD jobs, respectively. A low-severity flaw, CVE-2026-3855 (CVSSv3 3.1), could allow authenticated users to access restricted files or cause a denial of service.
GitLab has released security updates addressing these vulnerabilities in versions 19.3.2, 19.2.6, and 19.1.8. The company strongly urges all self-managed customers to upgrade immediately. GitLab.com is already running the patched release, and GitLab Dedicated customers require no action. These patches collectively fix issues across various GitLab CE/EE versions, with affected versions generally preceding the 19.1.8, 19.2.6, and 19.3.2 releases.
This coordinated disclosure event highlights the importance of timely patching for GitLab instances. The range of vulnerabilities, from remote code execution to authorization bypasses, presents a significant risk to organizations running self-managed deployments. Users should prioritize updating to the latest patched versions to mitigate these security threats.
Key Findings:
- A batch of 12 CVEs was disclosed for GitLab CE/EE on September 16, 2026.
- High-severity flaws include RCE (CVE-2026-88765), policy execution bypass (CVE-2026-79708), and unauthorized HTTP requests (CVE-2026-78252).
- Unauthenticated DoS vulnerabilities (CVE-2026-1168, CVE-2025-14871) were also patched.
- Patches are available in GitLab versions 19.3.2, 19.2.6, and 19.1.8.
- Self-managed GitLab instances are strongly urged to update immediately.
CVEs addressed include CVE-2026-86341, CVE-2026-7514, CVE-2026-79708, CVE-2026-78252, CVE-2026-3855, CVE-2026-1168, CVE-2026-19619, CVE-2026-16794, CVE-2025-14871, CVE-2026-88765, CVE-2026-13210, and CVE-2026-12910.
A stylized GitLab logo composed of interlocking code blocks, with several blocks showing error symbols and one block emitting a faint red glow.