Loading story…
GitLab released security updates for Community Edition and Enterprise Edition, shipping versions 18.10.3, 18.9.5, and 18.8.9 to address multiple vulnerabilities tracked as CVE-2026-5173, CVE-2026-1092, CVE-2025-12664, and CVE-2026-1101. The patched issues include a high-severity flaw that could allow unintended server-side method invocation over WebSocket connections, along with several denial-of-service weaknesses affecting the Terraform state lock API and the GraphQL API.
The release also fixes medium- and low-severity bugs including cross-site scripting in analytics dashboards, code-injection-related IP leakage in Code Quality reports, authorization weaknesses in APIs and custom roles, and information disclosure through GraphQL queries and CSV export. GitLab said GitLab.com had already been patched, GitLab Dedicated customers did not need to take action, and self-managed customers should upgrade immediately; the company added that the updates require no new migrations and should not cause downtime in multi-node deployments.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
CVE records for CVE-2026-5173, CVE-2026-1092, CVE-2025-12664, and CVE-2026-1101 were published on April 8, 2026. These records correspond to vulnerabilities addressed in the GitLab security patch release.
GitLab released security patch versions 18.10.3, 18.9.5, and 18.8.9 for GitLab Community Edition and Enterprise Edition on April 8, 2026, and urged self-managed customers to upgrade immediately. The patches addressed multiple vulnerabilities including a high-severity unintended server-side method invocation issue over websocket connections, several denial-of-service flaws, and additional medium- and low-severity bugs.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
cve.org
Open sourcecve.org
Open sourcecve.org
Open sourcecve.org
Open sourcedocs.gitlab.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
GitLab released security updates for Community Edition and Enterprise Edition in versions **18.10.3**, **18.9.5**, and **18.8.9**, patching multiple vulnerabilities that affect self-managed deployments and urging administrators to upgrade immediately. The fixes address high-severity issues including a websocket access control flaw, denial-of-service conditions, and unintended server-side command execution tied to vulnerabilities such as `CVE-2026-5173`, `CVE-2026-1092`, and `CVE-2025-12664`. The release also resolves medium- and low-severity weaknesses involving code injection, cross-site scripting, GraphQL-related denial of service, CSV import and export handling, authorization bypasses, and information disclosure affecting private projects, protected environments, and custom roles. GitLab said some affected code paths date back to versions as old as 11.3 and 12.10, while **GitLab.com** and **GitLab Dedicated** are already protected; the company added that the patches require no new migrations and can be applied to multi-node deployments without downtime, although Omnibus packages still restart services during updates.
Jun 29, 2026
GitLab released patch versions **18.6.2**, **18.5.4**, and **18.4.6** for GitLab Community Edition and Enterprise Edition to fix multiple security flaws affecting self-managed deployments. The company said **GitLab.com** was already patched and **GitLab Dedicated** customers did not need to take action, while administrators running affected self-managed versions were urged to upgrade immediately. The fixes were tied to several CVE records, including `CVE-2025-12029`, `CVE-2025-12716`, `CVE-2025-8405`, and `CVE-2025-11984`. The patched issues included several **high-severity** vulnerabilities, such as cross-site scripting in Wiki and Swagger UI, improper encoding in vulnerability reports, and a denial-of-service condition in GraphQL endpoints. GitLab also addressed medium- and low-severity flaws involving WebAuthn, ExifTool processing, the Commit API, compliance frameworks, error messages, and merge request titles. The release included database migrations that could cause downtime on single-node deployments, although multi-node environments could use GitLab's zero-downtime upgrade procedures.
Jul 24, 2026
GitLab released security updates `18.8.4`, `18.7.4`, and `18.6.6` for Community Edition and Enterprise Edition to fix multiple vulnerabilities affecting self-managed deployments, and urged customers to upgrade immediately. The most severe issue, **CVE-2025-7659** with CVSS `8.0`, is an incomplete validation flaw in the Web IDE that could allow an unauthenticated attacker to steal tokens and gain access to private repositories. GitLab.com had already been patched, and GitLab Dedicated customers were not required to take action. The release also addressed additional vulnerabilities tracked as **CVE-2025-8099**, **CVE-2026-0958**, **CVE-2026-0595**, and **CVE-2025-14560**, covering several denial-of-service conditions, cross-site scripting, HTML injection, server-side request forgery, and authorization bypasses across GitLab CE/EE and EE. GitLab said the patch release includes database migrations that may cause downtime on single-node deployments, while multi-node environments can avoid downtime by following zero-downtime upgrade procedures.
Jul 24, 2026