Loading story…
GitLab released security updates 17.10.1, 17.9.3, and 17.8.6 for Community Edition and Enterprise Edition to fix multiple vulnerabilities affecting self-managed deployments. The company said GitLab.com had already been patched and GitLab Dedicated customers did not need to take action, but urged self-managed administrators to upgrade immediately because the release addressed several high- and medium-severity issues across the platform.
The patched set includes two high-severity cross-site scripting flaws, a high-severity privilege persistence issue, and additional access control, resource consumption, and command injection weaknesses. GitLab linked the fixes to CVE-2025-2255, CVE-2025-0811, CVE-2025-2242, CVE-2024-12619, CVE-2024-10307, and CVE-2024-9773, and also disclosed a prompt injection issue in the Amazon Q integration that was still awaiting CVE assignment at the time of the release.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
On March 26, 2025, GitLab released versions 17.10.1, 17.9.3, and 17.8.6 for Community Edition and Enterprise Edition and urged self-managed customers to upgrade immediately. The patches addressed multiple issues, including CVE-2025-2255, CVE-2025-0811, CVE-2025-2242, CVE-2024-12619, CVE-2024-10307, and CVE-2024-9773, while GitLab.com had already been patched.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
docs.gitlab.com
Open sourcecve.mitre.org
Open sourcecve.mitre.org
Open sourcecve.mitre.org
Open sourcecve.mitre.org
Open sourcecve.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
GitLab released patched Community Edition and Enterprise Edition versions `17.2.2`, `17.1.4`, and `17.0.6` to fix multiple medium-severity security vulnerabilities affecting self-managed deployments. GitLab.com was already running the remediated version, and the company urged administrators of affected self-managed instances to upgrade immediately. The update addressed a broad range of issues, including privilege escalation, cross-project access, several denial-of-service conditions, cross-site scripting, sensitive data exposure in logs, approval bypass, and audit log credential retention. CVEs tied to the release included `CVE-2024-4210`, `CVE-2024-5423`, and `CVE-2024-6356`, alongside other assigned identifiers such as `CVE-2024-3035`, `CVE-2024-2800`, `CVE-2024-6329`, `CVE-2024-4207`, `CVE-2024-3958`, `CVE-2024-4784`, `CVE-2024-3114`, and `CVE-2024-7586`, with two additional issues still awaiting CVE assignment at publication time.
Jul 24, 2026
GitLab released security updates for self-managed GitLab Community Edition and Enterprise Edition, publishing versions **17.9.1**, **17.8.4**, and **17.7.6** to fix five vulnerabilities and urging administrators to upgrade immediately. The issues include two high-severity cross-site scripting flaws tracked as **`CVE-2025-0475`** and **`CVE-2025-0555`**, along with three medium-severity authorization or injection weaknesses identified as **`CVE-2024-8186`**, **`CVE-2024-10925`**, and **`CVE-2025-0307`**. GitLab said **GitLab.com** was already running the patched version and that **GitLab Dedicated** customers did not need to take action, leaving self-managed deployments as the primary exposure point. The fixes apply across multiple supported release lines, and the vendor framed the update as an urgent security patch cycle for affected CE and EE installations.
Jul 24, 2026
GitLab released security updates for Community Edition and Enterprise Edition in versions **16.6.1**, **16.5.3**, and **16.4.3**, urging affected self-managed installations to upgrade immediately. The fixes addressed multiple vulnerabilities spanning **XSS, privilege escalation, information disclosure, authorization bypass, package registry access issues, protected branch and pipeline schedule permission bypasses, and client-side denial of service**. The most severe issue was **`CVE-2023-6033`**, a high-severity cross-site scripting flaw in Jira integration configuration, while GitLab said **GitLab.com** was already running the patched version. One of the patched Enterprise Edition issues, **`CVE-2023-4658`**, was an incorrect authorization flaw that allowed a guest user to abuse the **"Allowed to merge"** permission when that right was inherited through a group. GitLab rated that bug **CVSS 3.1 / Low** and said it affected versions from **8.13 before 16.4.3**, **16.5 before 16.5.3**, and **16.6 before 16.6.1**. The release also included fixes for unauthorized access to release descriptions and other EE-specific authorization weaknesses, along with bundled component updates for **Mattermost**, **PostgreSQL**, and **pcre2**.
Jul 24, 2026