{ "description": "Browse aymeric's, an independent, searchable archive of readable snapshots from followed feeds, preserved in Git with aggr.", "feed_url": "https://aggr.aymericbeaumet.com/sources/docs.gitlab.com/feed.json", "home_page_url": "https://aggr.aymericbeaumet.com/sources/docs.gitlab.com/", "items": [ { "authors": [ { "name": "artooro" } ], "content_html": "

On October 21, 2026, we released versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13 for GitLab Community Edition (CE) and Enterprise Edition (EE).

\n

These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated tenants running 19.3.5-internal0 and 19.4.2-internal0 or later already include these fixes and do not need to take action.

\n

GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases: scheduled releases and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays. For more information, please visit our releases handbook and security FAQ. You can see all of GitLab release blog posts here.

\n

For security fixes, the issues detailing each vulnerability are made public on our issue tracker 90 days after the release in which they were patched.

\n

We are committed to ensuring that all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. To maintain good security hygiene, it is highly recommended that all customers upgrade to the latest patch release for their supported version. You can read more best practices in securing your GitLab instance in our blog post.

\n

Recommended Action

\n

We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible.

\n

When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, it means all types are affected.

\n

Security fixes

\n

Table of security fixes

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
TitleSeverity
Integer Overflow issue in Regular Expression Compiler impacts GitLab CE/EECritical
Improper Authentication issue in OmniAuth-to-LDAP auto-linking email lookup impacts GitLab CE/EEHigh
Cache Poisoning issue in OAuth/OIDC discovery endpoints impacts GitLab CE/EEHigh
Improper Access Control issue in GraphQL work item email address field impacts GitLab CE/EEMedium
Incomplete enforcement of instance-wide SAML/LDAP membership lock allows unauthorized member additions in GitLab EEMedium
Internal Credential Exposure issue in internal response headers impacts GitLab CE/EEMedium
Authorization Bypass Through User-Controlled Key issue in group milestones API impacts GitLab CE/EEMedium
Use of Less Trusted Source issue in AI Gateway feature enablement header impacts GitLab EEMedium
Use of Cache Containing Sensitive Information issue in merge request title rendering impacts GitLab CE/EELow
Improper Access Control issue in merge request approval policy enforcement impacts GitLab EELow
Improper Cleanup on Thrown Exception issue in security findings impacts GitLab EELow
Improper Access Control issue in group Duo admin-lock enforcement for Amazon Q settings impacts GitLab EELow
\n

CVE-2026-110264 - Integer Overflow issue in Regular Expression Compiler impacts GitLab CE/EE

\n

GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression.

\n

In addition to our standard patch releases, we have backported this fix to GitLab CE/EE versions 18.11.13, 19.0.10, 19.1.9, and 19.2.9.

\n

Impacted Versions: GitLab CE/EE: all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1
\nCVSS 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)

\n

Thanks joaxcar for reporting this vulnerability through our HackerOne bug bounty program

\n

Detecting CVE-2026-110264 Exploitation Attempts

\n

GitLab security has released two threat detections to support customers with self-managed instances, listed below. GitLab-managed infrastructure, including GitLab.com and GitLab Dedicated, remains patched.

\n\n

CVE-2026-15723 - Improper Authentication issue in OmniAuth-to-LDAP auto-linking email lookup impacts GitLab CE/EE

\n

GitLab has remediated an issue that, when OmniAuth SAML and LDAP auto-linking were both enabled, an authenticated user could have taken over an existing LDAP-backed account without any interaction from the targeted user, due to improper input sanitization in the LDAP email lookup path used during OmniAuth identity linking.

\n

Impacted Versions: GitLab CE/EE: all versions from 10.1 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1
\nCVSS 8.2 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N)

\n

Thanks stealthy for reporting this vulnerability through our HackerOne bug bounty program

\n

CVE-2026-112212 - Cache Poisoning issue in OAuth/OIDC discovery endpoints impacts GitLab CE/EE

\n

GitLab has remediated an issue that, under certain conditions, an unauthenticated user could have poisoned a shared cache’s OAuth/OIDC discovery document to redirect certain flows to an externally controlled server, due to improper trust of user-supplied values when constructing endpoint URLs in cached discovery responses.

\n

Impacted Versions: GitLab CE/EE: all versions from 18.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1
\nCVSS 7.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:L)

\n

This vulnerability has been discovered internally by GitLab team member Peter Arts

\n

CVE-2026-12664 - Improper Access Control issue in GraphQL work item email address field impacts GitLab CE/EE

\n

GitLab has remediated an issue that, under certain conditions, could have allowed an authenticated user with a read_api-scoped token to retrieve a project’s incoming email address and create work items, bypassing the token’s restrictions, due to insufficient scope enforcement on a GraphQL field.

\n

Impacted Versions: GitLab CE/EE: all versions from 18.2 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1
\nCVSS 6.8 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N)

\n

Thanks go7f0 for reporting this vulnerability through our HackerOne bug bounty program

\n

CVE-2026-16255 - Incomplete enforcement of instance-wide SAML/LDAP membership lock allows unauthorized member additions in GitLab EE

\n

GitLab has remediated an issue that, when the instance-wide SAML or LDAP membership lock was enabled, an authenticated user could have granted or accepted project and group membership outside the identity provider’s control, due to incomplete enforcement of the membership lock on requests created before the lock was enabled.

\n

Impacted Versions: GitLab EE: all versions from 12.0 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1
\nCVSS 5.9 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N)

\n

Thanks 3nvz for reporting this vulnerability through our HackerOne bug bounty program

\n

GitLab has remediated an issue that, under certain conditions, an unauthenticated user could have retrieved sensitive internal server credentials due to improper filtering of internal response headers.

\n

Impacted Versions: GitLab CE/EE: all versions from 17.6.5 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1
\nCVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

\n

Thanks altair00 for reporting this vulnerability through our HackerOne bug bounty program

\n

CVE-2026-13319 - Authorization Bypass Through User-Controlled Key issue in group milestones API impacts GitLab CE/EE

\n

GitLab has remediated an issue that could have allowed an authenticated user to read milestone metadata, including titles, descriptions, and full project paths, from arbitrary private projects across the instance without any project membership, due to missing authorization checks on a user-supplied project filter parameter in the group milestones API.

\n

Impacted Versions: GitLab CE/EE: all versions from 15.10 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1
\nCVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

\n

Thanks a0xnirudh for reporting this vulnerability through our HackerOne bug bounty program

\n

GitLab has remediated an issue that under certain conditions could have allowed an authenticated user to access paid AI features without a valid subscription due to insufficient server-side validation in billing eligibility checks.

\n

Impacted Versions: GitLab EE: all versions from 17.8 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1
\nCVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)

\n

This vulnerability has been discovered internally by GitLab team member Halil Coban

\n

CVE-2026-105711 - Use of Cache Containing Sensitive Information issue in merge request title rendering impacts GitLab CE/EE

\n

GitLab has remediated an issue that, when a merge request in a public project referenced a confidential issue from a private project, an authenticated user with no project membership could have read the confidential issue’s title, due to a viewer-independent fragment cache key that incorrectly shared per-user-redacted rendered content across all users.

\n

Impacted Versions: GitLab CE/EE: all versions from 15.0 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1
\nCVSS 3.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N)

\n

Thanks 20kilograma for reporting this vulnerability through our HackerOne bug bounty program

\n

CVE-2026-14288 - Improper Access Control issue in merge request approval policy enforcement impacts GitLab EE

\n

GitLab has remediated an issue that under certain conditions could have allowed an authenticated user to bypass a required merge request approval policy on a protected branch due to improper access control during approval rule synchronization.

\n

Impacted Versions: GitLab EE: all versions from 17.4 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1
\nCVSS 3.1 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N)

\n

Thanks 3nvz for reporting this vulnerability through our HackerOne bug bounty program

\n

CVE-2026-112326 - Improper Cleanup on Thrown Exception issue in security findings impacts GitLab EE

\n

GitLab has remediated an issue that, under certain conditions, could have allowed an authenticated user with read-only permissions to permanently delete existing vulnerability records due to improper cleanup logic that failed to distinguish between pre-existing records from newly created ones during error handling.

\n

Impacted Versions: GitLab EE: all versions from 17.8 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1
\nCVSS 3.1 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N)

\n

This vulnerability has been discovered internally by GitLab team member Gregory Havenga

\n

CVE-2026-103515 - Improper Access Control issue in group Duo admin-lock enforcement for Amazon Q settings impacts GitLab EE

\n

GitLab has remediated an issue that, when an instance administrator locked a group’s Duo availability, an authenticated user with group Owner permissions could have re-enabled AI-backed data egress to a third-party service for that group and its descendant projects, due to insufficient granularity of the admin-lock enforcement controls.

\n

Impacted Versions: GitLab EE: all versions from 19.2 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1
\nCVSS 2.7 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N)

\n

Thanks 3nvz for reporting this vulnerability through our HackerOne bug bounty program

\n

Bug fixes

\n

19.5.1

\n\n

19.4.3

\n\n

19.3.6

\n\n

19.2.9

\n\n

19.1.9

\n\n

19.0.10

\n\n

18.11.13

\n\n

Important notes on upgrading

\n

This patch includes database migrations that may impact your upgrade process.

\n

Impact on your installation:

\n\n

Regular migrations

\n

The following versions include regular migrations that run during the upgrade process:

\n\n

Post-deploy migrations

\n

The following versions include post-deploy migrations that can run after the upgrade:

\n\n

To learn more about the impact of upgrades on your installation, see:

\n\n

Updating

\n

To update GitLab, see the Update page. To update GitLab Runner, see the Updating the Runner page.

\n

Receive Patch Notifications

\n

To receive patch blog notifications delivered to your inbox, visit our contact us page. To receive release notifications via RSS, subscribe to our patch release RSS feed or our RSS feed for all releases.

\n", "date_modified": "2026-10-21T19:01:12+00:00", "date_published": "2026-10-21T19:01:12+00:00", "external_url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/", "id": "urn:aggr:item:cfcd72470d9e3747534f8ccc96bf21945a854054", "summary": "On October 21, 2026, we released versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13 for GitLab Community Edition (CE) and Enterprise Edition (EE). These versions contain important bug and security fixes, and we strongly…", "tags": [ "news" ], "title": "GitLab Critical Patch Release", "url": "https://aggr.aymericbeaumet.com/items/hnrss-org/2026-10-21-gitlab-critical-patch-release/" } ], "language": "en", "title": "docs.gitlab.com", "version": "https://jsonfeed.org/version/1.1" }