GitLab has issued critical security updates for its Community Edition (CE) and Enterprise Edition (EE), addressing 13 vulnerabilities that could expose sensitive data, manipulate CI/CD pipelines, and disrupt server operations. The patched versions—19.2.1, 19.1.3, and 19.0.5—were released on July 29, 2026. Administrators of self-managed instances are strongly advised to upgrade immediately to mitigate potential risks.
Key Vulnerabilities Addressed
Among the most severe issues is CVE-2026-6267, a high-severity flaw with a CVSS score of 8.5. This vulnerability in GitLab Workhorse allows authenticated users with Developer-level access to retrieve sensitive information from internal requests due to improper access control mechanisms.
Another critical vulnerability, CVE-2026-12436, involves a mass-assignment flaw in the Pipeline Schedule API. Attackers can exploit this to modify CI/CD configurations belonging to other users, potentially leading to unauthorized pipeline executions and compromising the integrity of development workflows.
CVE-2026-15975 is a denial-of-service (DoS) vulnerability that unauthenticated attackers can exploit. By abusing insufficient resource throttling in merge request discussions, attackers may crash or significantly degrade server performance, affecting availability in production environments.
Additional Vulnerabilities
The update also addresses several medium-severity vulnerabilities impacting authorization and access control mechanisms. These include improper authorization in project import functionality, unauthorized access to pipeline test reports, and exposure of confidential issue titles through merge request metadata.
Additionally, a race condition in merge request approval rules could allow code to be merged into protected branches without the necessary approvals, posing a risk to software integrity.
Other issues fixed include a cross-site scripting (XSS) vulnerability that could allow the execution of malicious JavaScript through crafted URLs, a prompt injection vulnerability in GitLab Duo Code Review, and a security token generation flaw in Duo Workflows that could bypass governance controls.
Potential Attack Scenarios
One potential attack scenario involves a low-privilege developer exploiting the Pipeline Schedule API flaw to modify scheduled jobs in another project. This could lead to the injection of malicious scripts into the CI/CD pipeline, resulting in supply chain compromises, unauthorized deployments, or data exfiltration without immediate detection.
GitLab has stated that all vulnerabilities will be publicly disclosed 90 days after the patches are released, in line with responsible disclosure practices. The company emphasizes that keeping installations up to date is critical to protecting sensitive code repositories and development workflows.
Given the critical nature of these vulnerabilities, it’s imperative for organizations using GitLab to prioritize these updates. Regular patching and vigilant monitoring are essential to maintaining the security and integrity of development environments.
