Loading story…
GitLab released security updates for Community Edition and Enterprise Edition, shipping versions 19.2.1, 19.1.3, and 19.0.5 to fix 13 vulnerabilities and urging self-managed customers to upgrade immediately. GitLab said GitLab.com is already patched and GitLab Dedicated customers do not need to take action. The most severe issue, CVE-2026-6267, affects internal request handling in GitLab Workhorse and could let an authenticated user with the Developer role access unauthorized information because of insufficient access controls; affected versions span 10.1.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
A new CVE entry, CVE-2026-12436, was received on July 29, 2026 for a GitLab CE/EE vulnerability that could let an authenticated user modify another user's CI/CD configuration under certain conditions. The issue affects versions 18.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1.
On July 29, 2026, GitLab released security patch versions 19.2.1, 19.1.3, and 19.0.5 for GitLab CE/EE to fix 13 vulnerabilities, including high-severity issues involving information exposure, CI/CD pipeline manipulation, and denial of service. GitLab said GitLab.com was already patched, GitLab Dedicated customers did not need to act, and urged self-managed customers to upgrade immediately.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
7 references tracked. Mallory keeps watching after this page renders.
cert.ug
Open sourcemalware.news
Open sourcecyber.gc.ca
Open sourcecybersecuritynews.com
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcedocs.gitlab.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
GitLab released **19.0.2**, **18.11.5**, and **18.10.8** for self-managed Community Edition and Enterprise Edition deployments to fix **11 security vulnerabilities** and additional bugs, and urged administrators to upgrade immediately. The advisory says all versions before those releases are affected, while **GitLab.com** has already been patched and **GitLab Dedicated** customers do not need to take action. GitLab also warned that the update includes database migrations that may cause downtime on single-node instances, though multi-node environments can use zero-downtime upgrade procedures. The most severe issue, **`CVE-2026-6552`** (**CVSS 8.7**), is an improper authorization flaw in GitLab EE's Group SAML identity management that could let an authenticated **group Owner** take over another group member's account under certain conditions. GitLab also fixed **`CVE-2026-10087`**, an Analytics Dashboard cross-site scripting flaw in GitLab EE that could allow an authenticated **developer** to execute arbitrary client-side code in a victim's browser. The broader patch set addresses additional risks including denial of service in Grape API JSON parsing, SSRF, unauthorized access to confidential data, and other authorization bypasses, and government and vendor advisories have called on organizations to apply the patched versions.
Jul 25, 2026
GitLab released security updates `17.3.2`, `17.2.5`, and `17.1.7` for self-managed Community Edition and Enterprise Edition instances, fixing 18 vulnerabilities including a critical issue tracked as `CVE-2024-6678` with a CVSS score of 9.9. The flaw could let an attacker trigger a CI/CD pipeline as an arbitrary user and perform a stop action under certain conditions. GitLab said GitLab.com is already running the patched version and GitLab Dedicated customers do not need to take action. The release also fixes several high-severity bugs, including command injection into a connected Cube server via YAML configuration (`CVE-2024-8640`), server-side request forgery through Maven Dependency Proxy requests to internal resources (`CVE-2024-8635`), and a denial-of-service condition caused by a crafted POST request or large `glm_source` parameter (`CVE-2024-8124`). Additional medium-severity patches address token and session abuse, permission bypasses, information disclosure, and open redirects that could contribute to account takeover through broken OAuth flows, and GitLab urged all self-managed administrators to upgrade immediately.
Jul 24, 2026
GitLab released security updates `17.3.2`, `17.2.5`, and `17.1.7` for self-managed Community Edition and Enterprise Edition to fix multiple vulnerabilities, including the critical `CVE-2024-6678`. GitLab said the flaw can let an attacker trigger a pipeline as an arbitrary user under certain circumstances and assigned it a `CVSS 9.9`, urging customers to upgrade immediately. GitLab.com had already been patched, and GitLab Dedicated customers did not need to take action. The patch bundle also addressed three high-severity issues and numerous medium- and low-severity flaws affecting pipelines, Product Analytics, Dependency Proxy, OAuth flows, CI/CD variables, repository mirroring, and access controls. A separate CVE entry for `CVE-2024-8640` was listed without public details, while GitLab also noted one issue involving arbitrary unclaimed provider identities had not yet received a CVE at the time of publication.
Jul 24, 2026