Loading story…
GitLab released security updates 18.8.4, 18.7.4, and 18.6.6 for Community Edition and Enterprise Edition to fix multiple vulnerabilities affecting self-managed deployments, and urged customers to upgrade immediately. The most severe issue, CVE-2025-7659 with CVSS 8.0, is an incomplete validation flaw in the Web IDE that could allow an unauthenticated attacker to steal tokens and gain access to private repositories. GitLab.com had already been patched, and GitLab Dedicated customers were not required to take action.
The release also addressed additional vulnerabilities tracked as CVE-2025-8099, CVE-2026-0958, CVE-2026-0595, and CVE-2025-14560, covering several denial-of-service conditions, cross-site scripting, HTML injection, server-side request forgery, and authorization bypasses across GitLab CE/EE and EE. GitLab said the patch release includes database migrations that may cause downtime on single-node deployments, while multi-node environments can avoid downtime by following zero-downtime upgrade procedures.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
In the patch release details, GitLab identified CVE-2025-7659 as the most severe vulnerability addressed, describing it as a Web IDE incomplete validation flaw that could allow an unauthenticated attacker to steal tokens and access private repositories. The issue was rated high severity with a CVSS score of 8.0.
GitLab released security patch versions 18.8.4, 18.7.4, and 18.6.6 for GitLab Community Edition and Enterprise Edition, fixing multiple vulnerabilities and urging self-managed customers to upgrade immediately. GitLab.com was already patched, and GitLab Dedicated customers did not need to take action.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
cve.org
Open sourcecve.org
Open sourcecve.org
Open sourcecve.org
Open sourcedocs.gitlab.com
Open sourcecve.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
GitLab released patch versions **18.6.2**, **18.5.4**, and **18.4.6** for GitLab Community Edition and Enterprise Edition to fix multiple security flaws affecting self-managed deployments. The company said **GitLab.com** was already patched and **GitLab Dedicated** customers did not need to take action, while administrators running affected self-managed versions were urged to upgrade immediately. The fixes were tied to several CVE records, including `CVE-2025-12029`, `CVE-2025-12716`, `CVE-2025-8405`, and `CVE-2025-11984`. The patched issues included several **high-severity** vulnerabilities, such as cross-site scripting in Wiki and Swagger UI, improper encoding in vulnerability reports, and a denial-of-service condition in GraphQL endpoints. GitLab also addressed medium- and low-severity flaws involving WebAuthn, ExifTool processing, the Commit API, compliance frameworks, error messages, and merge request titles. The release included database migrations that could cause downtime on single-node deployments, although multi-node environments could use GitLab's zero-downtime upgrade procedures.
Jul 24, 2026
GitLab released patched Community Edition and Enterprise Edition versions `18.8.2`, `18.7.2`, and `18.6.4` to remediate five disclosed vulnerabilities affecting self-managed deployments. The fixes include a high-severity two-factor authentication bypass issue and four denial-of-service flaws, two rated high severity and two rated medium severity. Related CVE records were published for `CVE-2026-0723`, `CVE-2025-13927`, `CVE-2026-1102`, `CVE-2025-13335`, and `CVE-2025-13928`. GitLab said GitLab.com was already running the patched version and that GitLab Dedicated customers did not need to take action, but urged self-managed customers to upgrade immediately. The company also warned that the patch release includes database migrations that can cause downtime on single-node instances unless operators use zero-downtime upgrade procedures in multi-node environments.
Jul 24, 2026
GitLab released security updates for *Community Edition (CE)* and *Enterprise Edition (EE)*, shipping patched versions **18.8.4**, **18.7.4**, and **18.6.6** for self-managed deployments (with GitLab.com already remediated). The most severe issue, **CVE-2025-7659** (CVSS **8.0**), was attributed to *incomplete validation* in the **Web IDE** that could allow an **unauthenticated** attacker to steal access tokens and use them to access **private repositories**. The same release also addressed multiple high-severity availability and client-side issues, including **CVE-2025-8099** (CVSS **7.5**) enabling **DoS** via repeated/complex **GraphQL** queries and **CVE-2026-0958** (CVSS **7.5**) enabling resource exhaustion by bypassing **JSON validation middleware** limits. Additional fixes included CPU-exhaustion vectors involving specially crafted **Markdown** processing (e.g., **CVE-2026-1456** and **CVE-2026-1458**) and an **XSS** issue in code flow functionality (**CVE-2025-14560**, CVSS **7.3**) that could enable malicious script execution in a victim’s browser session.
Jun 29, 2026