GitLab Releases Critical Patches for Multiple Vulnerabilities, Including Path Traversal and Insecure Deserialization
GitLab has issued urgent patch releases (19.3.2, 19.2.6, 19.1.8) to address a critical path traversal flaw (CVE-2026-85706) and other high-severity vulnerabilities affecting both Community and Enterprise Editions.
GitLab has released critical patch versions 19.3.2, 19.2.6, and 19.1.8 for its Community Edition (CE) and Enterprise Edition (EE) software, urging all self-managed installations to upgrade immediately. The updates address a range of vulnerabilities, with two critical flaws standing out: a path traversal issue in the repository commits API and an insecure deserialization vulnerability in the GraphQL subscription serializer.
The critical path traversal vulnerability, identified as CVE-2026-85706, allows unauthenticated users to read arbitrary files from the GitLab server. This is due to improper path confinement and missing authentication enforcement in the API. The vulnerability affects all versions from 18.7 prior to the patched releases and carries a CVSS score of 10.0, indicating a critical severity.
Another critical vulnerability, CVE-2026-87719, impacts GitLab EE and relates to insecure deserialization in the GraphQL subscription serializer. Under specific conditions, an authenticated user with Duo Chat access could exploit this flaw to bypass serialization and obtain Advanced Search instance configurations and sensitive credentials. This vulnerability has a CVSS score of 9.9.
Beyond these critical issues, the patch releases also fix several high-severity vulnerabilities. These include a buffer overflow in the Unicode conversion wrapper (CVE-2026-88765) in GitLab EE, which could lead to remote code execution. Additionally, high-severity flaws related to scheduled pipeline execution policy tests allowing developers to access protected CI/CD variables (CVE-2026-79708), cross-site scripting (XSS) in the Markdown JSON table renderer, and incorrect authorization in CI/CD environment variable scope matching have been remediated.
Several other high-severity Denial of Service (DoS) vulnerabilities in the GraphQL complexity limiter, a race condition in Merge Request Pipelines, and improper authentication issues in SAML SSO sign-in restriction enforcement are also addressed. Medium-severity flaws, including insufficient protection of credentials, XSS in the Content Editor, and authorization bypasses in protected environment approval rules, have also been patched.
GitLab.com is already running the patched version, and GitLab Dedicated customers do not need to take any action. For self-managed instances, it is strongly recommended to upgrade to the latest patch release for the supported version to maintain good security hygiene. Details of the security fixes are made public on GitLab's issue tracker 90 days after the release in which they were patched.
The company emphasizes its commitment to maintaining high security standards for all aspects of GitLab exposed to customers or hosting customer data. Users are advised to consult GitLab's security releases page and documentation for detailed information on the vulnerabilities and the recommended upgrade paths.
This comprehensive patch release underscores the ongoing efforts by GitLab to address a wide array of security weaknesses, from critical unauthenticated exploits to more nuanced authorization and input validation flaws, ensuring the integrity and security of its widely used platform.