GitLab Fixes DoS, Code Injection, and Access Control Flaws in Self-Managed Instances

GitLab released security updates for Community Edition and Enterprise Edition in versions 18.10.3, 18.9.5, and 18.8.9, patching multiple vulnerabilities that affect self-managed deployments and urging administrators to upgrade immediately. The fixes address high-severity issues including a websocket access control flaw, denial-of-service conditions, and unintended server-side command execution tied to vulnerabilities such as CVE-2026-5173, CVE-2026-1092, and CVE-2025-12664.

The release also resolves medium- and low-severity weaknesses involving code injection, cross-site scripting, GraphQL-related denial of service, CSV import and export handling, authorization bypasses, and information disclosure affecting private projects, protected environments, and custom roles. GitLab said some affected code paths date back to versions as old as 11.3 and 12.10, while GitLab.com and GitLab Dedicated are already protected; the company added that the patches require no new migrations and can be applied to multi-node deployments without downtime, although Omnibus packages still restart services during updates.