Advisories
GitLab 19.2.1/19.1.3/19.0.5 Patch: Sensitive Info Exposure & Mass Assignment Fixes
GitLab released critical patch versions 19.2.1, 19.1.3, and 19.0.5 on July 29, 2026, addressing a high‑severity sensitive information exposure in Workhorse and a mass‑assignment vulnerability. All self‑managed CE and EE deployments must upgrade immediately; GitLab.com and Dedicated customers are already patched.
What happened
On July 29, 2026 GitLab issued patch releases 19.2.1, 19.1.3, and 19.0.5 for both Community and Enterprise Editions. The updates contain a high‑severity sensitive information exposure in Workhorse and a mass‑assignment flaw that could allow attackers to set arbitrary attributes on resources.
Impact
- All self‑managed installations running any of the affected versions are vulnerable.
- GitLab.com and Dedicated customers are already on the patched releases.
- Potential data leakage and unauthorized attribute manipulation.
What to do
- Verify your GitLab version; if it is 19.2.x < 19.2.1, 19.1.x < 19.1.3, or 19.0.x < 19.0.5, plan an upgrade.
- Apply the patch using your preferred deployment method (Omnibus, source, Helm).
- After upgrade, review audit logs for any suspicious activity and enforce strict attribute whitelisting if applicable.
Additional Guidance
Maintain a regular patch cadence: GitLab releases scheduled patches twice a month on the second and fourth Wednesdays. Monitor the issue tracker for 90‑day disclosure of vulnerability details.
Related vulnerabilities
GitLab 16.9.8 Patch Release: Bug Fixes, No Security Updates
On May 9 2024 GitLab released 16.9.8 for Community and Enterprise Editions. The update addresses regressions and bugs but contains no security fixes. Defenders should apply the patch, review the auto‑reconfigure behavior, and use /etc/gitlab/skip‑auto‑reconfigure to avoid downtime in multi‑node setups.
Read briefing
Chromium CVE-2026-106418: Missing Authorization in Edge and Chrome
A missing authorization flaw (CVE‑2026‑106418) was discovered in Chromium, affecting all Chromium‑based browsers including Microsoft Edge. The issue is fixed in the latest releases; defenders should verify that their browsers are up‑to‑date and monitor for any anomalous access attempts.
Read briefing
Microsoft Office Word CVE‑2026‑108433 Fix Omitted from Update List – No Action Needed
Microsoft Office Word had a security feature bypass vulnerability (CVE‑2026‑108433) that was fixed in the October 2026 security update. The CVE was mistakenly omitted from the public advisory, but users who have installed the update are already protected. Defenders should verify update status and install any missing patches.
Read briefing
Microsoft Office Word CVE-2026-108439 RCE – Omitted from October 2026 Patch
Microsoft identified that the October 2026 security update for Office Word did not list CVE‑2026‑108439, a remote code execution flaw. The patch already contains the fix, so systems that applied the October 2026 updates are protected. Defenders should verify that the October 2026 update is installed and monitor for any unpatched environments.
Read briefing