GitLab Patch Release: 19.2.1, 19.1.3, 19.0.5

On July 29, 2026, we released versions 19.2.1, 19.1.3, 19.0.5 for GitLab Community Edition (CE) and Enterprise Edition (EE).

These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action.

GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases: scheduled releases and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays. For more information, please visit our releases handbook and security FAQ. You can see all of GitLab release blog posts here.

For security fixes, the issues detailing each vulnerability are made public on our issue tracker 90 days after the release in which they were patched.

We are committed to ensuring that all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. To maintain good security hygiene, it is highly recommended that all customers upgrade to the latest patch release for their supported version. You can read more best practices in securing your GitLab instance in our blog post.

Recommended Action

We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible.

When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, it means all types are affected.

Security fixes

Table of security fixes

CVE-2026-6267 - Sensitive Information Exposure issue in Workhorse impacts GitLab CE/EE

GitLab has remediated an issue that under certain conditions could have allowed an authenticated user with Developer role to access unauthorized information due to insufficient access controls on internal request handling.

Impacted Versions: GitLab CE/EE: all versions from 10.1.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1
CVSS 8.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H)

Thanks thwin_htet for reporting this vulnerability through our HackerOne bug bounty program

CVE-2026-12436 - Mass Assignment issue in Pipeline Schedule API impacts GitLab CE/EE

GitLab has remediated an issue that under certain conditions could have allowed an authenticated user to modify CI/CD configuration belonging to another user due to improper validation of user-supplied attributes when processing pipeline schedule inputs.

Impacted Versions: GitLab CE/EE: all versions from 18.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1
CVSS 8.4 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L)

Thanks a0xnirudh for reporting this vulnerability through our HackerOne bug bounty program

CVE-2026-15975 - Denial of Service issue in Merge Request Discussions impacts GitLab CE/EE

GitLab has remediated an issue that under certain conditions could have allowed an unauthenticated user to cause a denial of service due to insufficient resource throttling when processing merge request discussions.

Impacted Versions: GitLab CE/EE: all versions from 11.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1
CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

This vulnerability has been discovered internally by GitLab team member Hordur Freyr Yngvason

CVE-2026-13113 - Race Condition issue in merge request approval rules impacts GitLab EE

GitLab has remediated an issue that under certain conditions could have allowed an authenticated user to merge code into a protected branch without the required approvals due to a race condition in approval rule processing.

Impacted Versions: GitLab EE: all versions from 17.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1
CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)

This vulnerability has been discovered internally by GitLab team member Niklas Janz

CVE-2026-16553 - Insufficiently Protected Credentials issue in Virtual Registries impacts GitLab EE

GitLab has remediated an issue that under certain conditions could have allowed some sensitive information to be disclosed to an unintended host due to improper handling of upstream requests in virtual registries.

Impacted Versions: GitLab EE: all versions from 18.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1
CVSS 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L)

This vulnerability has been discovered internally by GitLab team member Fiona McCawley

CVE-2026-6336 - Improper Access Control issue in project import status impacts GitLab CE/EE

GitLab has remediated an issue that under certain conditions could have allowed an unauthorized user to view project import source information due to a missing authorization check.

Impacted Versions: GitLab CE/EE: all versions from 16.6 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1
CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Thanks 3nvz for reporting this vulnerability through our HackerOne bug bounty program

CVE-2026-14341 - Improper Authorization issue in project import functionality impacts GitLab CE/EE

GitLab has remediated an issue that under certain conditions could have allowed an authenticated user with Maintainer role to modify protected branch configuration due to improper authorization in a projects API endpoint.

Impacted Versions: GitLab CE/EE: all versions from 12.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1
CVSS 4.9 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N)

Thanks slide123 for reporting this vulnerability through our HackerOne bug bounty program

CVE-2026-3093 - Cross-site Scripting issue in paginated views impacts GitLab CE/EE

GitLab has remediated an issue that under certain conditions could have allowed an attacker to execute arbitrary JavaScript in another user’s browser via a crafted URL, due to improper sanitization of user-controlled input.

Impacted Versions: GitLab CE/EE: all versions from 14.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1
CVSS 4.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N)

Thanks go7f0 for reporting this vulnerability through our HackerOne bug bounty program

CVE-2026-15077 - Prompt Injection issue in Duo Code Review impacts GitLab EE

GitLab has remediated an issue that under certain conditions could have allowed an authenticated user to access information from unauthorized projects due to improper neutralization of untrusted content processed by the AI-assisted code review functionality.

Impacted Versions: GitLab EE: all versions from 19.1 before 19.1.3 and 19.2 before 19.2.1
CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

This vulnerability has been discovered internally by GitLab team member Mike Wronski

CVE-2026-15831 - Incorrect Security Token Generation issue in Duo Workflows impacts GitLab EE

GitLab has remediated an issue that under certain conditions could have allowed an authenticated user to bypass administrator-configured tool governance policies due to improper authorization enforcement during token generation.

Impacted Versions: GitLab EE: all versions from 19.1 before 19.1.3 and 19.2 before 19.2.1
CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)

This vulnerability has been discovered internally by GitLab team member Dennis Appelt

CVE-2026-14351 - Exposure of Sensitive Information issue in merge request title generation impacts GitLab CE/EE

GitLab has remediated an issue that under certain conditions could have allowed an unauthenticated user to view the title of a confidential issue through a publicly accessible merge request due to improper authorization checks.

Impacted Versions: GitLab CE/EE: all versions from 8.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1
CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

Thanks toofikz for reporting this vulnerability through our HackerOne bug bounty program

CVE-2026-4672 - Improper Access Control issue in Pipeline Test Report API impacts GitLab CE/EE

GitLab has remediated an issue that under certain conditions could have allowed an authenticated user with guest-role permissions to access test report contents they were not authorized to view due to improper access control enforcement.

Impacted Versions: GitLab CE/EE: all versions from 18.4 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1
CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

Thanks rogerace for reporting this vulnerability through our HackerOne bug bounty program

CVE-2025-14562 - Incorrect Authorization issue in merge request collaboration settings impacts GitLab CE/EE

GitLab has remediated an issue that under certain conditions could have allowed an authenticated user with developer-role permissions to commit changes to a project after being removed as a member, due to improper authorization checks on merge request collaboration settings.

Impacted Versions: GitLab CE/EE: all versions from 10.6 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1
CVSS 3.1 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N)

Thanks theluci for reporting this vulnerability through our HackerOne bug bounty program

Bug fixes

19.2.1

• Backport final 19.2 release notes
• [19.2] Backport of “Remove –unlink-first and –recursive-unlink from tar extract”
• [19.2] Backport of Revert “Merge branch ‘jmd/fix-merge-request-reapprove-reunapprove’ into ‘master’”
• Backport “Enforce admin Duo lock on group settings update” to 19.2
• Backport of ‘Fix keys.organization_id NOT NULL constraint failure on Self-Managed/Dedicated upgrades’ to 19.2
• 19.2 backport of feat(danger): Block post-deploy migrations on security MRs
• [19.2] Delete orphaned caches in helm metadata cache backfill
• Backport ‘Restore AI infrastructure settings after 19.2 upgrades’ to 19-2-stable-ee
• Backport of ‘Fix HTTP_V2 config leak breaking unrelated specs’
• Backport of “Fix self-hosted DWS TLS setting ignored in flow validation and metadata”
• Backport of ‘Fix self-managed admin/owner cannot enroll namespaces into Orbit’
• Backport of ‘Enable Orbit and Knowledge Graph feature flags by default’
• Backport of Fix silent data loss in Advanced Search routing for >128 root_ancestor_ids

19.1.3

• Update gitlab-logger to v4.0.1 (19-1-stable)
• Backport of “Allow AIGW timeout setting on GitLab Dedicated instances”
• Backport of “Fixes the Copy commit SHA button in commits list”
• Backport of ‘Keep virtual registry settings toggle visible when disabled’ into 19.1
• Merge branch ‘ss/revert-cb7f0fd33375’ into ‘master’
• Backport of “Fix blob preview diff hiding blank added lines”
• Fix nil error when checking checkpoints that are not fully instantiated (19-1 backport)
• Backport of ‘Fix commit list date grouping to use committedDate’
• Backport of ‘Backfill duo_secret_detection_fp_enabled to false’
• Backport of “Add label to skip release note category validation”
• Backport of ‘Fix missing source code in inline blame for legacy file types’
• Backport of “Added a note about ci/cd analytics”
• Backport of “Handle claim conflict when creating placeholder users”
• Backport of “E2E: Perform first time onboarding via UI if presented for E2E tests” into 19.1
• Backport of ‘Fix keys.organization_id NOT NULL constraint failure on Self-Managed/Dedicated upgrades’ to 19.1
• Backport of “Fix self-hosted DWS TLS setting ignored in flow validation and metadata”
• [19.1] Backport of ‘Update net-imap to v0.6.4.1’
• Stop validating web_hook_logs_daily sharding key constraint (19.1 backport)
• Backport 19.1 of “Fix infinite retry on detected language rename”
• Backport ‘Clean up orphan indices in elastic test teardown’ (19.1)
• [19.1] Backport of “Remove –unlink-first and –recursive-unlink from tar extract”
• Backport of ‘Fix approval rule editing locked by non-instance settings’
• 19.1 backport of feat(danger): Block post-deploy migrations on security MRs
• [19.1] Enable LFK cleanup LATERAL join by default
• [19.1] Delete orphaned caches in helm metadata cache backfill
• Backport of ‘Fix self-managed admin/owner cannot enroll namespaces into Orbit’
• Merge branch ‘ramereth/9940-selinux-fcontext-equivalence-el10’ into ‘19-1-stable’
• Set QA test targets for 19.1.0+rc42.ee.0
• [19.1 Backport] Bump PostgreSQL to 17.10
• Merge branch ‘renovate/openssl-openssl-3.x’ into ‘19-1-stable’
• 19.1 Backport: Merge branch ‘add-retry-to-manifest-upload’ into ‘master’
• Bump gitlab-omnibus-builder version to 5.60.2
• [19.1] Backport of ‘Uninstall the default net-imap gem shipped with Ruby’
• [19.1] CI: Authenticate gitlab.com clones via GIT_CONFIG_GLOBAL file

19.0.5

• Update gitlab-logger to v4.0.1 (19-0-stable)
• Backport of “Allow AIGW timeout setting on GitLab Dedicated instances”
• Backport of ‘Keep virtual registry settings toggle visible when disabled’ into 19.0
• Fix live note updates not reflecting reactively
• Backport of “Fix blob preview diff hiding blank added lines”
• Backport of ‘Backfill duo_secret_detection_fp_enabled to false’
• Fix nil error when checking checkpoints that are not fully instantiated (19-0 backport)
• Backport of ‘Fix keys.organization_id NOT NULL constraint failure on Self-Managed/Dedicated upgrades’ to 19.0
• [19.0] Backport of ‘Update net-imap to v0.6.4.1’
• [19.0] Backport of “Remove –unlink-first and –recursive-unlink from tar extract”
• Stop validating web_hook_logs_daily sharding key constraint (19.0 backport)
• Backport ‘Clean up orphan indices in elastic test teardown’ (19.0)
• Backport of ‘Fix approval rule editing locked by non-instance settings’
• 19.0 backport of feat (danger): Block post-deploy migrations on security MR
• Backport of “Remove GIT_CONFIG_GLOBAL=/dev/null from Duo Workflow git hardening”
• [19.0] Rewrite LFK cleanup query as LATERAL join
• [19.0] Delete orphaned caches in helm metadata cache backfill
• Backport 19.0 of “Fix infinite retry on detected language rename”
• Backport of ‘Fix self-managed admin/owner cannot enroll namespaces into Orbit’
• Merge branch ‘ramereth/9940-selinux-fcontext-equivalence-el10’ into ‘19-0-stable’
• Set QA test targets for 19.0.0+rc42.ee.0
• [19.0 Backport] Bump PostgreSQL to 17.10
• 19.0 Backport: Merge branch ‘add-retry-to-manifest-upload’ into ‘master’
• Bump gitlab-omnibus-builder version to 5.57.2
• [19.0] Backport of ‘Uninstall the default net-imap gem shipped with Ruby’
• [19.0] CI: Authenticate gitlab.com clones via GIT_CONFIG_GLOBAL file

Important notes on upgrading

This patch includes database migrations that may impact your upgrade process.

Impact on your installation:

• Single-node instances: This patch will cause downtime during the upgrade as migrations must complete before GitLab can start.
• Multi-node instances: With proper zero-downtime upgrade procedures, this patch can be applied without downtime.

Post-deploy migrations

The following versions include post-deploy migrations that can run after the upgrade:

• 19.2.1
• 19.1.3
• 19.0.5

To learn more about the impact of upgrades on your installation, see:

• Zero-downtime upgrades for multi-node deployments
• Standard upgrades for single-node installations

Updating

To update GitLab, see the Update page. To update GitLab Runner, see the Updating the Runner page.

Receive Patch Notifications

To receive patch blog notifications delivered to your inbox, visit our contact us page. To receive release notifications via RSS, subscribe to our patch release RSS feed or our RSS feed for all releases.