GitLab Patch Release: 18.11.3, 18.10.6, 18.9.7 | GitLab Docs

On May 13, 2026, GitLab released patch versions 18.11.3, 18.10.6, and 18.9.7 for CE and EE. The releases address multiple high-severity security vulnerabilities, including cross-site scripting, denial of service, authorization, and access-control issues. GitLab strongly recommends that all affected self-managed installations upgrade immediately.

Release Scope and Upgrade Guidance

• Applies to GitLab Community Edition and Enterprise Edition.
• GitLab.com is already patched; GitLab Dedicated customers do not need to act.
• Patch releases may be scheduled or issued urgently for critical vulnerabilities.
• Security vulnerability details are published publicly 30 days after the fixing release.
• Unless otherwise specified, all deployment types—including Omnibus, source installations, and Helm charts—are affected.

Cross-Site Scripting Vulnerabilities

Several authenticated-user XSS vulnerabilities could allow arbitrary JavaScript to execute in other users’ browsers:

• CVE-2026-7481: Affects EE Analytics dashboard chart rendering; exploitable by users with Developer permissions.
• CVE-2026-5297: Affects global search in CE and EE.
• CVE-2026-6073: Affects EE Duo Agent output rendering.
• CVE-2026-7377: Affects customizable EE Analytics dashboards.
• Each issue received a CVSS score of 8.7 and resulted from improper input sanitization.

Denial-of-Service Vulnerabilities

The release fixes multiple unauthenticated denial-of-service issues involving malformed requests or files:

• CVE-2026-1659: Specially crafted requests to the CI/CD job update API could disrupt service.
• CVE-2025-14870: Malformed JSON payloads targeting the Duo Workflows API could cause a denial of service.
• CVE-2025-14869: Certain internal API endpoints were vulnerable to specially crafted payloads.
• CVE-2026-1184: A specially crafted file uploaded through Insights Configuration could cause service disruption.
• The API-related issues were rated CVSS 7.5; the Insights issue was rated 6.5.

Authorization and Access-Control Issues

• CVE-2026-1322: An authenticated user with a read_api-scoped OAuth application could create issues and comment on private projects through GraphQL, due to improper token-scope enforcement. It received a CVSS score of 6.8.
• CVE-2026-4524: Authenticated users could access confidential issue content in public projects through the Issues API without proper authorization checks. It received a CVSS score of 6.5.

Recommended Action

Self-managed GitLab administrators should upgrade to the latest supported patch release—18.11.3, 18.10.6, or 18.9.7—as soon as possible, particularly because several vulnerabilities are remotely exploitable and require little or no authentication.