Loading story…
GitLab released CE and EE versions 19.3.1, 19.2.5, and 19.1.7 to remediate seven security vulnerabilities, led by CVE-2026-18252 (CVSS 8.7). The flaw lets an authenticated GitLab EE user with Developer privileges execute arbitrary commands in CI contexts by abusing user-controlled configuration processed by the GitLab Duo Claude AI agent. Affected EE releases span 18.9 through 19.1.6, 19.2 through 19.2.4, and 19.3 prior to 19.3.1; no workaround is available.
The patches also resolve authenticated denial-of-service issues involving background-job processing and SCIM provisioning, plus authorization and access-control weaknesses. GitLab.com and GitLab Dedicated are already patched, while self-managed customers should upgrade immediately; single-node deployments should plan for downtime while database migrations complete, whereas correctly configured multi-node deployments can use zero-downtime upgrade procedures. No exploitation of CVE-2026-18252 has been publicly confirmed.
Track how attackers are adapting to this technology.
1 event from the most recent confirmed update back to the earliest known activity.
GitLab released CE and EE versions 19.3.1, 19.2.5, and 19.1.7, remediating seven vulnerabilities, including CVE-2026-18252, which could let an authenticated EE Developer execute arbitrary commands in a CI context via user-controlled Duo Claude AI agent configuration. The release also fixed denial-of-service and authorization flaws; GitLab urged self-managed customers to upgrade, while GitLab.com was already patched and GitLab Dedicated required no action.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
7 references tracked. Mallory keeps watching after this page renders.
acn.gov.it
Open sourcesecurityonline.info
Open sourcedocs.gitlab.com
Open sourcetenable.com
Open sourcetenable.com
Open sourcetenable.com
Open sourcecommunity.tenable.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
GitLab released **19.1.2**, **19.0.4**, and **18.11.7** to fix eight security vulnerabilities in GitLab Community Edition and Enterprise Edition, including two high-severity script-injection issues. One of the disclosed flaws, **`CVE-2026-6896`**, is a **CWE-79** cross-site scripting vulnerability in GitLab EE that could let an authenticated user with **Developer** privileges execute arbitrary script in another user’s browser under certain conditions. The issue affects releases from **13.11** before **18.11.7**, **19.0** before **19.0.4**, and **19.1** before **19.1.2**. The patch set also addresses a medium-severity credential exposure issue and several authorization and access-control weaknesses. GitLab said **GitLab.com** was already patched and **GitLab Dedicated** customers do not need to take action, but urged operators of self-managed instances on affected versions to upgrade immediately. The release includes database migrations that may cause downtime on single-node deployments, while multi-node environments can avoid interruption by following GitLab’s zero-downtime upgrade procedures.
Jul 9, 2026
GitLab released patched Community Edition and Enterprise Edition versions `19.2.2`, `19.1.4`, and `19.0.6` to fix multiple security issues and urged self-managed customers to upgrade immediately. The update addresses high-, medium-, and low-severity vulnerabilities, including cross-site scripting, improper authorization, denial of service, and privilege assignment flaws. GitLab said GitLab.com was already running the fixed version, while GitLab Dedicated customers did not need to take action; the release also includes database migrations that may cause downtime for single-node instances during upgrade. The most severe issues include two high-severity XSS flaws in analytics dashboard components, tracked as **CVE-2026-15216** and **CVE-2026-15217**, each with a CVSS score of `8.7`, affecting GitLab CE/EE versions from `18.2` before `19.0.6`, `19.1` before `19.1.4`, and `19.2` before `19.2.2`. GitLab also fixed **CVE-2026-19228**, an authorization bypass issue in GitLab EE with a CVSS score of `8.5`, affecting `19.1` before `19.1.4` and `19.2` before `19.2.2`, which could let an authenticated user cause AI usage to be attributed to another namespace under certain conditions.
Aug 14, 2026
GitLab released security updates for Community Edition and Enterprise Edition, shipping versions **19.2.1**, **19.1.3**, and **19.0.5** to fix 13 vulnerabilities and urging self-managed customers to upgrade immediately. GitLab said **GitLab.com** is already patched and **GitLab Dedicated** customers do not need to take action. The most severe issue, **`CVE-2026-6267`**, affects internal request handling in GitLab Workhorse and could let an authenticated user with the **Developer** role access unauthorized information because of insufficient access controls; affected versions span **10.1.0 before 19.0.5**, **19.1 before 19.1.3**, and **19.2 before 19.2.1**.
Aug 3, 2026