GitLab CE/EE: Five Vulnerabilities Including Two Critical RCEs Disclosed Together
Key findings • GitLab CE/EE: Five vulnerabilities disclosed on September 24, 2026, including two critical RCE flaws. • Critical flaws CVE-2026-93577 and CVE-2026-89078 allow arbitrary code ex…
Key findings
- GitLab CE/EE: Five vulnerabilities disclosed on September 24, 2026, including two critical RCE flaws.
- Critical flaws CVE-2026-93577 and CVE-2026-89078 allow arbitrary code execution for authenticated users.
- Medium flaws permit scope escalation and merge request authorship spoofing.
- Low severity flaw involves incorrect user context in search results under race conditions.
- All issues patched in GitLab versions 19.2.7, 19.3.3, and 19.4.1; urgent upgrade recommended.
On September 24, 2026, GitLab Inc. disclosed five vulnerabilities affecting both GitLab Community Edition (CE) and Enterprise Edition (EE). The batch includes two critical severity flaws (CVSSv3 9.9), two medium severity flaws (CVSSv3 5.4 and 4.3), and one low severity flaw (CVSSv3 3.1). These vulnerabilities were patched in GitLab versions 19.2.7, 19.3.3, and 19.4.1.
Two critical vulnerabilities, CVE-2026-93577 and CVE-2026-89078, allow authenticated users to execute arbitrary code on the GitLab server. CVE-2026-93577 is due to an integer overflow issue during compilation of specially crafted code, while CVE-2026-89078 stems from a double-free issue when parsing a crafted regular expression.
A medium severity vulnerability, CVE-2026-92874 (CVSSv3 5.4), could allow an authenticated user with an MCP-scoped token to perform actions beyond their intended scope due to improper authorization. Another medium severity flaw, CVE-2026-92530 (CVSSv3 4.3), could permit an authenticated user to spoof merge request authorship and attribute content to arbitrary existing users on the target instance.
The low severity vulnerability, CVE-2026-92628 (CVSSv3 3.1), arises from a race condition in the MCP search tool's shared state handling, potentially causing search results to be returned under an incorrect user context.
GitLab has released versions 19.2.7, 19.3.3, and 19.4.1 to address these issues. All self-managed GitLab installations are strongly recommended to upgrade immediately. GitLab.com is already running the patched version, and GitLab Dedicated customers do not need to take action. This coordinated disclosure highlights the importance of timely patching for self-managed instances to mitigate risks associated with authenticated privilege escalation and code execution vulnerabilities.