GitLab Critical Patch Release: 19.4.1, 19.3.3, 19.2.7

On September 23, 2026, we released versions 19.4.1, 19.3.3, 19.2.7 for GitLab Community Edition (CE) and Enterprise Edition (EE).

These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action.

GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases: scheduled releases and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays. For more information, please visit our releases handbook and security FAQ. You can see all of GitLab release blog posts here.

For security fixes, the issues detailing each vulnerability are made public on our issue tracker 90 days after the release in which they were patched.

We are committed to ensuring that all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. To maintain good security hygiene, it is highly recommended that all customers upgrade to the latest patch release for their supported version. You can read more best practices in securing your GitLab instance in our blog post.

Recommended Action

We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible.

When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, it means all types are affected.

Security fixes

Table of security fixes

CVE-2026-89078 - Double Free issue in Regular Expression Parser impacts GitLab CE/EE

GitLab has remediated an issue that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due to a double free issue when parsing a specially crafted regular expression in a CI/CD configuration.

Impacted Versions: GitLab CE/EE: all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1
CVSS 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L)

Thanks joaxcar for reporting this vulnerability through our HackerOne bug bounty program

CVE-2026-93577 - Integer Overflow issue in Regular Expression Compiler impacts GitLab CE/EE

GitLab has remediated an issue that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due to an integer overflow issue when compiling a specially crafted regular expression in a CI/CD configuration.

Impacted Versions: GitLab CE/EE: all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1
CVSS 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)

Thanks joaxcar for reporting this vulnerability through our HackerOne bug bounty program

CVE-2026-84739 - Cross-site Scripting issue in merge request diff viewer impacts GitLab CE/EE

GitLab has remediated an issue that under certain conditions could have allowed an authenticated user to execute arbitrary JavaScript in the context of another user’s browser session due to improper sanitization of path components in the merge request diff viewer.

Impacted Versions: GitLab CE/EE: all versions from 13.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1
CVSS 8.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N)

Thanks joaxcar for reporting this vulnerability through our HackerOne bug bounty program

CVE-2026-92470 - Missing Authorization issue in Duo AI job troubleshooting feature impacts GitLab EE

GitLab has remediated an issue that under certain conditions could have allowed an authenticated user to access sensitive CI/CD variable values from debug-mode job traces through the Duo AI troubleshooting feature due to missing authorization checks.

Impacted Versions: GitLab EE: all versions from 18.7 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1
CVSS 7.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)

This vulnerability has been discovered internally by GitLab team member Daniel Prause

CVE-2026-92874 - Incorrect Authorization issue in MCP API scope enforcement impacts GitLab CE/EE

GitLab has remediated an issue that under certain conditions could have allowed an authenticated user with an MCP-scoped token to perform actions beyond the intended scope of that token due to improper authorization checks.

Impacted Versions: GitLab CE/EE: all versions from 18.3 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1
CVSS 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)

This vulnerability has been discovered internally by GitLab team member Amr Taha

CVE-2026-92530 - Use of Less Trusted Source issue in Direct Transfer import user mapping impacts GitLab CE/EE

GitLab has remediated an issue that under certain conditions could have allowed an authenticated user to spoof merge request authorship and attribute content to arbitrary existing users on the target instance due to improper reliance on ephemeral cache state during Direct Transfer imports.

Impacted Versions: GitLab CE/EE: all versions from 19.1 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1
CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)

Thanks ahacker1 for reporting this vulnerability through our HackerOne bug bounty program

CVE-2026-8937 - Missing Authorization issue in Epic Issues REST API impacts GitLab CE/EE

GitLab has remediated an issue that under certain conditions could have allowed an authenticated user to read private child issue contents, including titles and descriptions, from projects they had no access to, due to missing authorization checks on linked work items within visible epics.

Impacted Versions: GitLab CE/EE: all versions from 19.0 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1
CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

Thanks rogerace for reporting this vulnerability through our HackerOne bug bounty program

CVE-2026-92529 - Incorrect Authorization issue in Duo Workflow Service token governance enforcement impacts GitLab EE

GitLab has remediated an issue that under certain conditions could have allowed an authenticated user with developer-role permissions to bypass admin-configured AI tool governance controls for workflows in namespaces they do not control due to improper authorization checks.

Impacted Versions: GitLab EE: all versions from 19.1 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1
CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)

This vulnerability has been discovered internally by GitLab team member Rahul Barnwal

CVE-2026-10518 - Improper Access Control issue in GraphQL memberRoles dependentSecurityPolicies resolver impacts GitLab EE

GitLab has remediated an issue that under certain conditions could have allowed an authenticated user with guest-level permissions to read private security policy content they were not authorized to access due to improper authorization enforcement.

Impacted Versions: GitLab EE: all versions from 17.9 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1
CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

Thanks rogerace for reporting this vulnerability through our HackerOne bug bounty program

CVE-2026-4523 - Missing Authorization issue in GraphQL CI job trace API impacts GitLab CE/EE

GitLab has remediated an issue that under certain conditions could have allowed an unauthenticated user to read CI/CD job trace contents containing sensitive variable values due to improper authorization enforcement in the GraphQL API.

Impacted Versions: GitLab CE/EE: all versions from 15.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1
CVSS 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)

Thanks scyoon for reporting this vulnerability through our HackerOne bug bounty program

CVE-2026-92628 - Race Condition issue in MCP gitlab_search tool impacts GitLab CE/EE

GitLab has remediated an issue that under a race condition, the MCP search tool’s shared state handling could have caused search results to be returned under an incorrect user context.

Impacted Versions: GitLab CE/EE: all versions from 18.6 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1
CVSS 3.1 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N)

This vulnerability has been discovered internally by GitLab team member Chris Bonk

Bug fixes

19.4.1

• Backport 19.4 release notes
• Backport of ‘Resume mid-delta on the package metadata label path’ into 19-4-stable-ee
• Backport Add 19.4 release note: Improved table pasting in rich text editor
• Backport Add 19.4 release note: organization security dashboards
• Backport of ‘Add rate limit handling to imports from GHES’ to 19.4
• Backport of ‘Retry transient HttpIO chunk failures’ (19.4)
• [19.4] Bump gitlab-omnibus-builder version to 5.68.0

19.3.3

• Backport of Adjust docs following patches for "require a commit SHA for merge requests API"
• Backport of ‘Fix backfill migration overlap on empty CI partitions’ to 19-3-stable-ee
• Backport of Fix infinite loop parsing errored SARIF security reports (19.3)
• Backport of ‘Resolve orphan artifact lookups in one query per batch’
• Backport of ‘Specify low urgency of getPipelineDetails query’ to 19.3
• 19.3 Backport of ‘Remove merge_request from Developer default triggers’
• Backport ‘Drop system failure assertion in secrets specs’ to 19-3-stable-ee
• Backport of ‘Stop dependency proxy requests counting against the web rate limit’
• Backport of ‘Update GitLab Elasticsearch Indexer to 5.14.14’ to 19.3
• Backport of ‘Add application setting to block JWT for reclaimed project paths’
• Backport of ‘Resume mid-delta on the package metadata label path’ into 19-3-stable-ee
• Backport of ‘Retry transient HttpIO chunk failures’ (19.3)
• Bump PostgreSQL to version 17.11 (19-3-stable)
• Bump Consul to version 1.22.7 (19-3-stable)
• Merge branch ‘sdg-fips-staging-upload-internal-release’ into 19.3
• Backport !9672 to 19-3-stable: selinux: add sshd_session_t and sshd_auth_t rules for RHEL 10 / OpenSSH 9.8+
• Backport !9744 to 19-3-stable: Allow sshd fast SSH key lookup under SELinux
• Treat Patroni streaming state as a running node (backport to 19-3-stable)

19.2.7

• upgrade 19.2
• ‘Stop resetting mcp_server_enabled when Duo settings change’ to 19-2-stable-ee
• Restore Slack notifications documentation page (19.2 backport)
• Backport of ‘Fall back across resolved IPs in Gitlab::HTTP (Dependency Proxy 599)’
• Backport of ‘Fix backfill migration overlap on empty CI partitions’ to 19-2-stable-ee
• Backport of ‘Resolve orphan artifact lookups in one query per batch’
• Backport of ‘Update GitLab Elasticsearch Indexer to 5.14.14’ to 19.2
• Backport of ‘Specify low urgency of getPipelineDetails query’ to 19.2
• Backport ‘Drop system failure assertion in secrets specs’ to 19-2-stable-ee
• Backport of ‘Stop dependency proxy requests counting against the web rate limit’
• Backport of ‘Add application setting to block JWT for reclaimed project paths’
• Backport of ‘Resume mid-delta on the package metadata label path’ into 19-2-stable-ee
• Bump PostgreSQL to version 17.11 (19-2-stable)
• Bump Consul to version 1.22.7 (19-2-stable)
• Merge branch ‘sdg-fips-staging-upload-internal-release’ into 19.2
• Backport !9672 to 19-2-stable: selinux: add sshd_session_t and sshd_auth_t rules for RHEL 10 / OpenSSH 9.8+
• Backport !9744 to 19-2-stable: Allow sshd fast SSH key lookup under SELinux
• Treat Patroni streaming state as a running node (backport to 19-2-stable)

Important notes on upgrading

This patch includes database migrations that may impact your upgrade process.

Impact on your installation:

• Single-node instances: This patch will cause downtime during the upgrade as migrations must complete before GitLab can start.
• Multi-node instances: With proper zero-downtime upgrade procedures, this patch can be applied without downtime.

Post-deploy migrations

The following versions include post-deploy migrations that can run after the upgrade:

• 19.3.3
• 19.2.7

To learn more about the impact of upgrades on your installation, see:

• Zero-downtime upgrades for multi-node deployments
• Standard upgrades for single-node installations

Updating

To update GitLab, see the Update page. To update GitLab Runner, see the Updating the Runner page.

Receive Patch Notifications