GitLab Patches 13 Vulnerabilities, Addressing Data Exposure, Pipeline Manipulation, and DoS Risks
GitLab has released critical security updates to fix 13 vulnerabilities, including high-severity flaws that could lead to sensitive data exposure, manipulation of CI/CD pipelines, and denial-of-service conditions.
GitLab has issued urgent security updates to address a total of 13 vulnerabilities affecting its Community Edition (CE) and Enterprise Edition (EE). The patches, released on July 29, 2026, target flaws ranging from high to low severity, with the most critical ones posing risks of sensitive data exposure, unauthorized CI/CD pipeline manipulation, and server availability degradation.
Among the most significant issues is CVE-2026-6267, a high-severity vulnerability in GitLab Workhorse with a CVSS score of 8.5. This flaw allows authenticated users with Developer-level access to potentially retrieve sensitive internal information due to improper access controls. Another critical vulnerability, CVE-2026-12436, exploits a mass-assignment flaw in the Pipeline Schedule API. This enables attackers to alter CI/CD configurations belonging to other users, potentially leading to the execution of unauthorized pipeline jobs.
Furthermore, CVE-2026-15975 addresses a denial-of-service (DoS) vulnerability that can be exploited by unauthenticated attackers. By abusing insufficient resource throttling mechanisms within merge request discussions, attackers can cause server crashes or significant performance degradation, impacting the availability of GitLab instances.
The update also includes fixes for several medium-severity vulnerabilities. These address issues such as improper authorization in project import functionalities, unauthorized access to pipeline test reports, and the exposure of confidential issue titles through merge request metadata. A race condition in merge request approval rules could also allow code to be merged into protected branches without proper approvals, threatening code integrity.
Beyond core platform security, the patches tackle emerging risks in AI-assisted development tools. A prompt injection vulnerability in GitLab Duo Code Review and a security token generation flaw in Duo Workflows are among the addressed issues. These highlight the need for robust security measures as AI features become more integrated into development workflows.
GitLab strongly advises all self-managed users to upgrade to the patched versions: 19.2.1, 19.1.3, or 19.0.5. The company has confirmed that GitLab.com is already running the updated versions, and GitLab Dedicated customers require no action. The vulnerabilities are slated for public disclosure 90 days after the patch release, aligning with responsible disclosure practices.
Exploitation scenarios could involve a low-privilege developer leveraging the Pipeline Schedule API flaw to inject malicious scripts into CI/CD pipelines, potentially leading to supply chain compromises or unauthorized deployments. The company emphasizes that maintaining up-to-date installations is crucial for protecting sensitive code repositories and development workflows.
While multi-node environments can perform zero-downtime upgrades, single-node deployments may experience downtime due to necessary database migrations. Security teams should prioritize these updates, review access controls, and audit CI/CD configurations to mitigate the risks associated with these newly patched vulnerabilities.