Loading story…
GitLab released security updates for Community Edition and Enterprise Edition in versions 18.10.3, 18.9.5, and 18.8.9, patching multiple vulnerabilities that affect self-managed deployments and urging administrators to upgrade immediately. The fixes address high-severity issues including a websocket access control flaw, denial-of-service conditions, and unintended server-side command execution tied to vulnerabilities such as CVE-2026-5173, CVE-2026-1092, and CVE-2025-12664.
The release also resolves medium- and low-severity weaknesses involving code injection, cross-site scripting, GraphQL-related denial of service, CSV import and export handling, authorization bypasses, and information disclosure affecting private projects, protected environments, and custom roles. GitLab said some affected code paths date back to versions as old as 11.3 and 12.10, while GitLab.com and GitLab Dedicated are already protected; the company added that the patches require no new migrations and can be applied to multi-node deployments without downtime, although Omnibus packages still restart services during updates.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
GitLab stated that GitLab.com was already running the patched version and that GitLab Dedicated customers did not need to take action, indicating the fixes had already been deployed to hosted infrastructure. The company also noted the updates required no new migrations and should not require downtime for multi-node deployments.
On April 8, 2026, GitLab published patch releases 18.10.3, 18.9.5, and 18.8.9 for Community Edition and Enterprise Edition to fix multiple security vulnerabilities and bug fixes affecting self-managed deployments. GitLab urged all self-managed customers to upgrade immediately.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
ccb.belgium.be
Open sourcethecyberexpress.com
Open sourcecybersecuritynews.com
Open sourceabout.gitlab.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
GitLab released security updates for Community Edition and Enterprise Edition, shipping versions **18.10.3**, **18.9.5**, and **18.8.9** to address multiple vulnerabilities tracked as `CVE-2026-5173`, `CVE-2026-1092`, `CVE-2025-12664`, and `CVE-2026-1101`. The patched issues include a high-severity flaw that could allow unintended server-side method invocation over WebSocket connections, along with several denial-of-service weaknesses affecting the Terraform state lock API and the GraphQL API. The release also fixes medium- and low-severity bugs including cross-site scripting in analytics dashboards, code-injection-related IP leakage in Code Quality reports, authorization weaknesses in APIs and custom roles, and information disclosure through GraphQL queries and CSV export. GitLab said **GitLab.com** had already been patched, **GitLab Dedicated** customers did not need to take action, and self-managed customers should upgrade immediately; the company added that the updates require no new migrations and should not cause downtime in multi-node deployments.
Jul 24, 2026
GitLab released patch versions **18.6.2**, **18.5.4**, and **18.4.6** for GitLab Community Edition and Enterprise Edition to fix multiple security flaws affecting self-managed deployments. The company said **GitLab.com** was already patched and **GitLab Dedicated** customers did not need to take action, while administrators running affected self-managed versions were urged to upgrade immediately. The fixes were tied to several CVE records, including `CVE-2025-12029`, `CVE-2025-12716`, `CVE-2025-8405`, and `CVE-2025-11984`. The patched issues included several **high-severity** vulnerabilities, such as cross-site scripting in Wiki and Swagger UI, improper encoding in vulnerability reports, and a denial-of-service condition in GraphQL endpoints. GitLab also addressed medium- and low-severity flaws involving WebAuthn, ExifTool processing, the Commit API, compliance frameworks, error messages, and merge request titles. The release included database migrations that could cause downtime on single-node deployments, although multi-node environments could use GitLab's zero-downtime upgrade procedures.
Jul 24, 2026
GitLab released security updates `18.8.4`, `18.7.4`, and `18.6.6` for Community Edition and Enterprise Edition to fix multiple vulnerabilities affecting self-managed deployments, and urged customers to upgrade immediately. The most severe issue, **CVE-2025-7659** with CVSS `8.0`, is an incomplete validation flaw in the Web IDE that could allow an unauthenticated attacker to steal tokens and gain access to private repositories. GitLab.com had already been patched, and GitLab Dedicated customers were not required to take action. The release also addressed additional vulnerabilities tracked as **CVE-2025-8099**, **CVE-2026-0958**, **CVE-2026-0595**, and **CVE-2025-14560**, covering several denial-of-service conditions, cross-site scripting, HTML injection, server-side request forgery, and authorization bypasses across GitLab CE/EE and EE. GitLab said the patch release includes database migrations that may cause downtime on single-node deployments, while multi-node environments can avoid downtime by following zero-downtime upgrade procedures.
Jul 24, 2026