GitLab Releases Patches for Multiple Vulnerabilities, Including Critical Command Execution Flaw
GitLab has issued urgent patch releases for versions 19.3.1, 19.2.5, and 19.1.7, addressing several security vulnerabilities, most notably CVE-2026-18252 which allows authenticated users to execute arbitrary commands.
GitLab has released critical patch updates for its Community Edition (CE) and Enterprise Edition (EE) software, urging all self-managed installations to upgrade immediately. The new versions, 19.3.1, 19.2.5, and 19.1.7, address a range of security flaws, including a high-severity vulnerability that could permit authenticated users to execute arbitrary commands.
The most significant of these is CVE-2026-18252, rated with a CVSS score of 8.7. This vulnerability affects GitLab EE and allows an authenticated user with developer-role permissions to execute arbitrary commands within a CI context. The flaw arises from the Duo Claude AI agent processing configuration data from a user-controlled source, presenting a substantial risk to system integrity.
Beyond the command execution flaw, the patches also tackle several denial-of-service (DoS) vulnerabilities. CVE-2026-77801, a medium-severity issue in the import pipeline, could allow authenticated users to disrupt background job processing due to missing object count limits. Similarly, CVE-2025-10903, also medium-severity, affects the SCIM API and could enable authenticated users to cause a DoS by triggering an unbounded loop with specially crafted input in the user provisioning feature.
Several other medium-severity vulnerabilities related to access control and authorization have also been remediated. These include an improper access control issue in protected environments (CVE-2026-3035), an authorization bypass in compliance framework assignment (CVE-2026-4398), and improper handling of untrusted data in Pipeline Execution Policies (CVE-2026-15387).
Lower-severity issues addressed include an improper authorization flaw in merge request approval rules reset (CVE-2026-7487). GitLab emphasized that when a specific deployment type is not mentioned, all types are affected, reinforcing the need for prompt upgrades across the board.
GitLab.com is already running the patched versions, and GitLab Dedicated customers do not require any action. The company reiterated its commitment to high security standards and recommended that all customers maintain good security hygiene by upgrading to the latest patch releases for their supported versions.
Details of each vulnerability are typically made public on GitLab's issue tracker 90 days after the release in which they were patched. The company encourages users to consult their security FAQ and release handbook for more information on their patch release schedule and security practices.
Users are strongly advised to upgrade to the latest available versions to mitigate these risks. The affected versions for CVE-2026-18252 range from GitLab EE 18.9 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1. Similar version ranges apply to the other patched vulnerabilities, underscoring the broad impact of this release.