Advisories
GitLab CE/EE Patch 19.0.1, 18.11.4, 18.10.7 – Immediate Upgrade Required
GitLab released critical security patches for CE and EE on May 27 2026. The update addresses a high‑severity improper access control flaw in Duo AI workflow runners that could allow unauthorized access and potential denial of service. All self‑managed installations should upgrade immediately; GitLab.com and Dedicated customers are already protected.
What Happened
On May 27 2026, GitLab issued patch releases 19.0.1, 18.11.4, and 18.10.7 for both Community Edition (CE) and Enterprise Edition (EE). The updates contain bug fixes and a high‑severity security fix for an improper access control issue in Duo AI workflow runners.
Impact
• The vulnerability is classified as High severity and is present in all self‑managed CE and EE deployments that have not yet applied the patch.
• Attackers could gain unauthorized access to workflow runner resources and potentially trigger a denial of service condition.
• GitLab.com is already running the patched version; GitLab Dedicated customers do not need to act.
Recommended Action
All self‑managed GitLab installations must upgrade to the latest patch version for their supported release line without delay. The following versions are affected:
- CE 19.0.0 → 19.0.1
- CE 18.11.3 → 18.11.4
- CE 18.10.6 → 18.10.7
- EE 19.0.0 → 19.0.1
- EE 18.11.3 → 18.11.4
- EE 18.10.6 → 18.10.7
Deployers using omnibus, source, or Helm chart installations should follow the standard upgrade procedures documented in the GitLab release handbook.
Patch Release Schedule
GitLab releases scheduled patches twice a month on the second and fourth Wednesdays. Ad‑hoc critical patches are issued as needed for high‑severity vulnerabilities. Future vulnerability details will be disclosed 30 days after the patch release.
Related vulnerabilities
GitLab Self‑Managed Installations: Immediate Upgrade to 18.8.4/18.7.4/18.6.6 Required
GitLab released critical patch releases 18.8.4, 18.7.4, and 18.6.6 on Feb 10 2026, addressing high‑severity vulnerabilities including an incomplete validation flaw in Web IDE and a denial‑of‑service issue. All self‑managed CE and EE deployments must update immediately; GitLab.com and Dedicated customers are already patched.
Read briefing
GitLab 19.2.1/19.1.3/19.0.5 Patch: Sensitive Info Exposure & Mass Assignment Fixes
GitLab released critical patch versions 19.2.1, 19.1.3, and 19.0.5 on July 29, 2026, addressing a high‑severity sensitive information exposure in Workhorse and a mass‑assignment vulnerability. All self‑managed CE and EE deployments must upgrade immediately; GitLab.com and Dedicated customers are already patched.
Read briefing
GitLab 18.3.1/18.2.5/18.1.5 Patch Addresses Medium‑Severity Resource Allocation Vulnerability
GitLab released patch versions 18.3.1, 18.2.5, and 18.1.5 on August 27, 2025 to fix a medium‑severity resource‑allocation flaw in the import function that could allow an attacker to exhaust system resources. All self‑managed CE and EE installations must upgrade immediately; GitLab.com and Dedicated customers are already protected.
Read briefing
GitLab Security Release 16.3.1/16.2.5/16.1.5: Fixes for Privilege Escalation and Token Leakage
GitLab has issued security patches for versions 16.3.1, 16.2.5, and 16.1.5 to fix a privilege escalation flaw that allowed external users to gain internal group access and a token leakage issue that could expose Sentry credentials. All installations of CE and EE should upgrade immediately. GitLab.com is already running the patched version.
Read briefing