GitLab Releases Urgent Patches for Multiple High-Severity Vulnerabilities
GitLab has issued critical patch updates for versions 19.2.1, 19.1.3, and 19.0.5, addressing a range of security flaws including sensitive information exposure and mass assignment vulnerabilities.
GitLab has released urgent patch versions 19.2.1, 19.1.3, and 19.0.5 for both its Community Edition (CE) and Enterprise Edition (EE) to address a significant number of vulnerabilities, including several rated as high-severity. The company strongly advises all self-managed GitLab installations to upgrade immediately to one of these patched versions to mitigate potential security risks. GitLab.com instances have already been updated, and GitLab Dedicated customers do not require any action.
The security fixes target a variety of issues, with notable high-severity vulnerabilities including a Sensitive Information Exposure flaw in Workhorse (CVE-2026-6267) and a Mass Assignment vulnerability in the Pipeline Schedule API (CVE-2026-12436). Other critical fixes address Denial of Service in Merge Request Discussions, Cross-Site Scripting in paginated views, and Prompt Injection in Duo Code Review, among others. These patches are part of GitLab's commitment to maintaining high security standards for its platform and customer data.
The Sensitive Information Exposure vulnerability (CVE-2026-6267) in Workhorse could allow an authenticated user with Developer role to access unauthorized information under specific conditions due to insufficient access controls in internal request handling. This impacts all versions from 10.1.0 prior to the patched releases, with a CVSS score of 8.5.
Another critical flaw, CVE-2026-12436, a Mass Assignment issue in the Pipeline Schedule API, could permit an authenticated user to modify CI/CD configurations belonging to other users. This occurs due to improper validation of user-supplied attributes when processing pipeline schedule inputs. It affects versions from 18.0 before the patched releases and carries a CVSS score of 8.4.
Additionally, a Denial of Service vulnerability (CVE-2026-15975) in Merge Request Discussions could be exploited by an unauthenticated user to disrupt service, stemming from insufficient resource throttling. This impacts versions from 11.8 prior to the patched releases and has a CVSS score of 7.5.
Several medium-severity vulnerabilities were also patched, including a Race Condition in merge request approval rules (CVE-2026-13113), Insufficiently Protected Credentials in Virtual Registries (CVE-2026-16553), and multiple Improper Access Control and Authorization issues within project import functionalities and APIs. These vulnerabilities, while less severe, still pose risks to data integrity and system access.
GitLab releases security fixes through scheduled patch releases twice a month, typically on the second and fourth Wednesdays. However, critical vulnerabilities may also be addressed through ad-hoc critical patches. The company emphasizes the importance of maintaining good security hygiene by upgrading to the latest patch release for supported versions. Detailed information on each vulnerability is made public on GitLab's issue tracker 90 days after the release containing the fix.
Users are urged to consult the official GitLab release notes for a comprehensive list of all vulnerabilities addressed and to follow GitLab's best practices for securing their instances. Promptly applying these patches is crucial for protecting against potential exploitation and maintaining the integrity and confidentiality of data hosted on GitLab platforms.