On August 12, 2026, we released versions 19.2.2, 19.1.4, 19.0.6 for GitLab Community Edition (CE) and Enterprise Edition (EE).

These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action.

GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases: scheduled releases and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays. For more information, please visit our releases handbook and security FAQ. You can see all of GitLab release blog posts here.

For security fixes, the issues detailing each vulnerability are made public on our issue tracker 90 days after the release in which they were patched.

We are committed to ensuring that all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. To maintain good security hygiene, it is highly recommended that all customers upgrade to the latest patch release for their supported version. You can read more best practices in securing your GitLab instance in our blog post.

Recommended Action

We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible.

When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, it means all types are affected.

Security fixes

Table of security fixes

CVE-2026-15217 - Cross-site Scripting issue in Analytics Dashboards table field configuration impacts GitLab CE/EE

GitLab has remediated an issue that under certain conditions could have allowed cross-site scripting due to improper neutralization of user-controlled values rendered in table cell content by an analytics dashboard component.

Impacted Versions: GitLab CE/EE: all versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2
CVSS 8.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N)

Thanks yvvdwf for reporting this vulnerability through our HackerOne bug bounty program

GitLab has remediated an issue that under certain conditions could have allowed cross-site scripting due to improper neutralization of user-controlled data rendered in pagination controls by an analytics dashboard component.

Impacted Versions: GitLab CE/EE: all versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2
CVSS 8.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N)

Thanks yvvdwf for reporting this vulnerability through our HackerOne bug bounty program

GitLab has remediated an issue that under certain conditions could have allowed an authenticated user with developer-role permissions to execute CI/CD pipelines on a protected branch without the required push permissions due to improper authorization in pipeline reference validation.

Impacted Versions: GitLab CE/EE: all versions from 19.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2
CVSS 8.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N)

Thanks sim4n6 for reporting this vulnerability through our HackerOne bug bounty program

CVE-2026-19228 - Authorization Bypass issue in Duo Workflow Service impacts GitLab EE

GitLab has remediated an issue that under certain conditions could have allowed an authenticated user to cause AI usage to be attributed to another namespace, due to improper authorization of identity information supplied in requests.

Impacted Versions: GitLab EE: all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2
CVSS 8.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L)

This vulnerability was discovered internally by GitLab team member Dennis Appelt

CVE-2026-16627 - Cross-site Scripting issue in CI manual job confirmation modal impacts GitLab CE/EE

GitLab has remediated an issue that under certain conditions could have allowed an authenticated user with developer-role permissions to escalate privileges due to improper sanitization of HTML content rendered in a CI job modal.

Impacted Versions: GitLab CE/EE: all versions from 19.2 before 19.2.2
CVSS 7.7 (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N)

Thanks 3nvz for reporting this vulnerability through our HackerOne bug bounty program

CVE-2026-16494 - Missing Authorization issue in ProjectsController impacts GitLab EE

GitLab has remediated an issue that under certain conditions could have allowed an authenticated user to modify project settings restricted to higher-privileged roles, due to missing authorization checks on a project update endpoint.

Impacted Versions: GitLab EE: all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2
CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L)

Thanks 3nvz for reporting this vulnerability through our HackerOne bug bounty program

CVE-2026-7427 - Denial of Service issue in GraphQL API JSON parser impacts GitLab CE/EE

GitLab has remediated an issue that under certain conditions could have allowed an unauthenticated user to cause a denial of service due to improper input validation.

Impacted Versions: GitLab CE/EE: all versions from 18.5 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2
CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

Thanks aphantom for reporting this vulnerability through our HackerOne bug bounty program

CVE-2026-6821 - Missing Authorization issue in merge requests API impacts GitLab EE

GitLab has remediated an issue that under certain conditions could have allowed an authenticated user to bypass IP-based access restrictions and read limited merge request information from a private project due to missing authorization checks in a merge requests API endpoint.

Impacted Versions: GitLab EE: all versions from 12.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2
CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

Thanks rogerace for reporting this vulnerability through our HackerOne bug bounty program

CVE-2026-4879 - Missing Authorization issue in external status check API impacts GitLab EE

GitLab has remediated an issue that under certain conditions could have allowed an authenticated user with developer-role permissions to view external status check configuration restricted to higher-privileged roles due to missing authorization on a merge request API endpoint.

Impacted Versions: GitLab EE: all versions from 16.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2
CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

Thanks jaykp for reporting this vulnerability through our HackerOne bug bounty program

CVE-2026-8667 - Incorrect Authorization issue in npm dist-tags endpoint impacts GitLab CE/EE

GitLab has remediated an issue that under certain conditions could have allowed an authenticated user with developer role to modify certain package registry metadata without the required maintainer-level permissions due to improper authorization checks.

Impacted Versions: GitLab CE/EE: all versions from 17.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2
CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)

Thanks peppersghost for reporting this vulnerability through our HackerOne bug bounty program

CVE-2026-18244 - Missing Authorization issue in GitLab Duo settings page impacts GitLab EE

GitLab has remediated an issue that under certain conditions could have allowed an authenticated user to view restricted configuration settings due to improper authorization checks on a group settings page.

Impacted Versions: GitLab EE: all versions from 17.7 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2
CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

This vulnerability has been discovered internally by GitLab team member Félix Veillette-Potvin

CVE-2026-18433 - Incorrect Authorization issue in AI Tool Rules GraphQL resolver impacts GitLab EE

GitLab has remediated an issue that under certain conditions could have allowed an authenticated user to read policy configuration belonging to a namespace they were not authorized to access, due to incorrect authorization checks in a GraphQL query.

Impacted Versions: GitLab EE: all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2
CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

Thanks anshuman_bh for reporting this vulnerability through our HackerOne bug bounty program

CVE-2025-9486 - Incorrect Privilege Assignment issue in custom roles impacts GitLab EE

GitLab has remediated an issue that under certain conditions could have allowed a user with a pending membership to receive permissions granted by a custom role, due to incorrect privilege assignment that did not account for membership state.

Impacted Versions: GitLab EE: all versions from 15.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2
CVSS 3.3 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N)

Thanks mateuszek for reporting this vulnerability through our HackerOne bug bounty program

Bug fixes

19.2.2

• Backport of “Gate resolve-dependency-bump button to dependency bot MRs” to 19.2
• Backport of ‘Skip EventWorker enqueue in the Geo Log Cursor when sync_object_storage is disabled on the current node’
• Stop validating web_hook_logs_daily sharding key constraint (19.2 backport)
• Backport: Push agent_artifacts_page flag on project settings edit page
• Backport of ‘Sign Workhorse MCP client requests with the API JWT’
• Backport of ‘Pre-approve Orbit MCP tools in tool_access_policies claim’
• Remove headers within content tabs
• Backport of ‘Pre-approve GitLab MCP server read tools in the token claim’
• Backport Setup Siphon users rake task
• 19.2 Backport of ‘Fix 500 when securityReportFindings cursor is empty string’
• Fix work item drawer Open in full page on issue boards (backport to 19.2)
• Backport of “Trigger dep-bump resolution on merge request pipeline failures” to 19.2
• Backport of ‘Add Orbit settings alias for knowledge_graph’
• Backport !247590 to 19.2: Fix pipeline test report timeout on large pipelines
• Backport of ‘Add traversal_path sbom_component_versions to CH’ to 19.2
• Backport of “Preserve Geo verification retry fields across resyncs”
• Backport !241962 to 19.2: Make Ci::JobDefinition config size limit configurable - Fix failing pipelines when job config over 1 MiB
• Backport of ‘Fix Codex Agent to use gpt-5.3-codex instead of deprecated gpt-5.1-codex’
• Backport of “Fix duplicated content when copying across blob viewer chunks”
• Backport of ‘Geo: Add targeted container repository reverification task’
• [19.2] Remove project_id FKs from two Geo verification state tables
• Backport of ‘Add Siphon ClickHouse cleanup Rake task’
• [19.2] CI: Only set gitlab.com credential helper on gitlab.com
• Revert to jemalloc 5.3.0 (19-2-stable backport)

19.1.4

• Backport of ‘Pre-approve GitLab MCP server read tools in the token claim’
• Backport to 19.1: Release note CI job fix - MR pipelines only
• Backport changes Add rate limit to index integrity worker
• Backport of: Fix DUO_WORKFLOW_DEFINITION env var for custom flows
• Backport !247590 to 19.1: Fix pipeline test report timeout on large pipelines
• Backport of “Preserve Geo verification retry fields across resyncs”
• Backport !241962 to 19.1: Make Ci::JobDefinition config size limit configurable - Fix failing pipelines when job config over 1 MiB
• Backport of ‘Fix 500 when fetching vulnerability notes via REST API’
• 19.1 Backport of ‘Fix 500 when securityReportFindings cursor is empty string’
• Backport of “Fix duplicated content when copying across blob viewer chunks”
• Fix flaky quick_action_suggestions frame-guard spec
• Add siphon-tables image bundling Siphon CDC table definitions
• [19.1] CI: Only set gitlab.com credential helper on gitlab.com
• Revert to jemalloc 5.3.0 (19-1-stable backport)
• Bump CI image

19.0.6

• Backport of ‘Add postgres_index_bloat_estimate SQL function’
• Backport to 19.0: Release note CI job fixes: Skip label + MR pipelines only
• Backport !247590 to 19.0: Fix pipeline test report timeout on large pipelines
• Backport !241962 to 19.0: Make Ci::JobDefinition config size limit configurable - Fix failing pipelines when job config over 1 MiB
• Fix flaky transfer project and quick_action_suggestions frame-guard specs
• [19.0] Remove project_id FKs from two Geo verification state tables
• [19.0] CI: Only set gitlab.com credential helper on gitlab.com

Important notes on upgrading

This patch includes database migrations that may impact your upgrade process.

Impact on your installation:

• Single-node instances: This patch will cause downtime during the upgrade as migrations must complete before GitLab can start.
• Multi-node instances: With proper zero-downtime upgrade procedures, this patch can be applied without downtime.

Regular migrations

The following versions include regular migrations that run during the upgrade process:

• 19.2.2
• 19.0.6

Post-deploy migrations

The following versions include post-deploy migrations that can run after the upgrade:

• 19.2.2

To learn more about the impact of upgrades on your installation, see:

• Zero-downtime upgrades for multi-node deployments
• Standard upgrades for single-node installations

Updating

To update GitLab, see the Update page. To update GitLab Runner, see the Updating the Runner page.

Receive Patch Notifications

To receive patch blog notifications delivered to your inbox, visit our contact us page. To receive release notifications via RSS, subscribe to our patch release RSS feed or our RSS feed for all releases.