techlist.io
KREN
gitlab

GitLab Patch Release: 19.2.1, 19.1.3, 19.0.5 | GitLab Docs (opens in new tab)

gitlabci-cdapi-securityprompt-injectioncross-site-scriptingai-code-reviewworkhorse

GitLab released patch versions 19.2.1, 19.1.3, and 19.0.5 on July 29, 2026, addressing important security and bug fixes in CE and EE. Self-managed installations should upgrade immediately; GitLab.com is already patched, and GitLab Dedicated customers need no action. The release fixes vulnerabilities ranging from unauthorized data access and configuration changes to denial of service and AI-related security issues.

Release Scope and Upgrade Guidance

  • Applies to GitLab Community Edition and Enterprise Edition.
  • Affected self-managed installations should upgrade to:
    • 19.2.1
    • 19.1.3
    • 19.0.5
  • GitLab issues security patches through scheduled releases twice monthly or through urgent ad-hoc releases.
  • Vulnerability details are generally made public 90 days after the release containing the fix.

High-Severity Access and Configuration Vulnerabilities

  • CVE-2026-6267 — Workhorse information exposure (CVSS 8.5)

    • An authenticated Developer could access unauthorized information because of insufficient access controls in internal request handling.
    • Affected CE/EE versions extend back to 10.1.0.

  • CVE-2026-12436 — Pipeline Schedule API mass assignment (CVSS 8.4)

    • An authenticated user could modify another user’s CI/CD configuration through improperly validated pipeline schedule attributes.
    • Affects versions beginning with GitLab 18.0.

  • CVE-2026-13113 — Merge request approval race condition (CVSS 6.5)

    • In GitLab EE, an authenticated user could merge code into a protected branch without the required approvals.
    • The issue resulted from a race condition in approval rule processing.

  • CVE-2026-14341 — Project import authorization flaw (CVSS 4.9)

    • A Maintainer could modify protected branch configuration through a projects API endpoint.
    • The vulnerability affected CE and EE.

Availability, Import, and Credential Protection Fixes

  • CVE-2026-15975 — Merge request discussion denial of service (CVSS 7.5)

    • An unauthenticated attacker could exhaust resources and cause a denial of service.
    • The issue involved insufficient throttling when processing discussions.

  • CVE-2026-6336 — Project import status access control (CVSS 5.3)

    • An unauthorized user could view project import source information because of a missing authorization check.

  • CVE-2026-16553 — Virtual Registry credential exposure (CVSS 5.4)

    • Improper upstream request handling could disclose sensitive information to an unintended host.
    • This issue affects GitLab EE virtual registries.

Web and AI-Assisted Feature Fixes

  • CVE-2026-3093 — Cross-site scripting in paginated views (CVSS 4.7)

    • A crafted URL could execute attacker-controlled JavaScript in another user’s browser.
    • The root cause was inadequate sanitization of user-controlled input.

  • CVE-2026-15077 — Prompt injection in Duo Code Review (CVSS 4.3)

    • Untrusted content processed by AI-assisted code review could allow access to information from unauthorized projects.
    • This affects GitLab EE versions 19.1 and 19.2 before the patched releases.

  • CVE-2026-15831 — Duo Workflows token generation flaw (CVSS 4.3)

    • An authenticated user could bypass administrator-configured tool governance policies through improper authorization during token generation.
    • The issue affects GitLab EE.

Recommended Action

Administrators should upgrade affected self-managed GitLab installations to the latest supported patch release immediately, regardless of deployment method, including Omnibus, source installations, and Helm charts. Regularly applying the newest patch release is GitLab’s recommended security practice.