GitLab Security Patches Fix High-Severity WebSocket and DoS Flaws
Patch & Detection Intelligence · 5 sources · Updated 3mo ago · First seen Apr 8, 2026
GitLab released security updates for Community Edition and Enterprise Edition, shipping versions 18.10.3, 18.9.5, and 18.8.9 to address multiple vulnerabilities tracked as CVE-2026-5173, CVE-2026-1092, CVE-2025-12664, and CVE-2026-1101. The patched issues include a high-severity flaw that could allow unintended server-side method invocation over WebSocket connections, along with several denial-of-service weaknesses affecting the Terraform state lock API and the GraphQL API.
The release also fixes medium- and low-severity bugs including cross-site scripting in analytics dashboards, code-injection-related IP leakage in Code Quality reports, authorization weaknesses in APIs and custom roles, and information disclosure through GraphQL queries and CSV export. GitLab said GitLab.com had already been patched, GitLab Dedicated customers did not need to take action, and self-managed customers should upgrade immediately; the company added that the updates require no new migrations and should not cause downtime in multi-node deployments.
