Advisories
GitLab Security Release 16.3.1/16.2.5/16.1.5: Fixes for Privilege Escalation and Token Leakage
GitLab has issued security patches for versions 16.3.1, 16.2.5, and 16.1.5 to fix a privilege escalation flaw that allowed external users to gain internal group access and a token leakage issue that could expose Sentry credentials. All installations of CE and EE should upgrade immediately. GitLab.com is already running the patched version.
What happened
GitLab released security patches for versions 16.3.1, 16.2.5, and 16.1.5 to address two critical issues affecting both Community and Enterprise Editions.
Impact
- Privilege escalation: an external user could gain internal group access via a group service account (medium severity).
- Token leakage: a maintainer could expose a Sentry token by modifying configuration, potentially exposing sensitive data.
What to do
All installations running any of the affected versions must upgrade immediately to the patched releases. GitLab.com is already running the updated version. Verify your deployment type (omnibus, source, helm) and apply the corresponding update.
Best practices
Maintain a regular patch cadence, monitor GitLab’s security release schedule, and restrict external user permissions to the minimum required.
Related vulnerabilities
GitLab 17.11.7 Patch Release: Bug Fixes, No Security Updates
GitLab released version 17.11.7 on August 15 2025, addressing regressions and bugs without adding security fixes. The update includes backports, a container‑registry upgrade, and no new migrations, making it safe for multi‑node deployments.
Read briefing
GitLab 16.9.8 Patch Release: Bug Fixes, No Security Updates
On May 9 2024 GitLab released 16.9.8 for Community and Enterprise Editions. The update addresses regressions and bugs but contains no security fixes. Defenders should apply the patch, review the auto‑reconfigure behavior, and use /etc/gitlab/skip‑auto‑reconfigure to avoid downtime in multi‑node setups.
Read briefing
CISA Expands KEV Catalog with GitLab Path Traversal CVE-2026-85706
CISA has added CVE-2026-85706, a path‑traversal flaw in GitLab Community and Enterprise Editions, to its Known Exploited Vulnerabilities catalog after confirmed active exploitation. The move reinforces the agency’s push for rapid patching of high‑risk bugs under BOD 26‑04 and serves as a reminder for all organizations to prioritize KEV fixes.
Read briefing
GitLab Security Advisory: 16.6.1, 16.5.3, 16.4.3 Patch for XSS and ReDoS Vulnerabilities
GitLab released security patches 16.6.1, 16.5.3, and 16.4.3 to address critical XSS and ReDoS flaws in the Banzai Markdown pipeline and a privilege escalation flaw involving the admin_group_member custom permission. All Community Edition and Enterprise Edition installations below these versions are affected. Immediate upgrade is required.
Read briefing