Advisories
GitLab Self‑Managed Installations: Immediate Upgrade to 18.8.4/18.7.4/18.6.6 Required
GitLab released critical patch releases 18.8.4, 18.7.4, and 18.6.6 on Feb 10 2026, addressing high‑severity vulnerabilities including an incomplete validation flaw in Web IDE and a denial‑of‑service issue. All self‑managed CE and EE deployments must update immediately; GitLab.com and Dedicated customers are already patched.
GitLab announced the release of patch versions 18.8.4, 18.7.4, and 18.6.6 on February 10 2026. These updates contain critical security fixes for self‑managed Community and Enterprise editions.
What happened
Two high‑severity vulnerabilities were addressed: an incomplete input validation flaw in the Web IDE that could allow arbitrary code execution, and a denial‑of‑service condition in the GitLab core that could be triggered by malformed requests.
Impact
All self‑managed installations running any of the affected versions (18.8.x, 18.7.x, or 18.6.x) are vulnerable until updated. GitLab.com is already on the patched releases, and Dedicated customers do not need to take action.
What to do
- Verify the current GitLab version on your servers.
- If running a vulnerable version, upgrade immediately to 18.8.4, 18.7.4, or 18.6.6 depending on your supported branch.
- Test the upgrade in a staging environment before applying to production.
- Confirm that all deployment types (Omnibus, source, Helm, etc.) are updated.
- Review the GitLab security FAQ for any additional mitigations.
Maintaining the latest patch level is essential for protecting customer data and ensuring platform stability.
Related vulnerabilities
GitLab CE/EE Patch 19.0.1, 18.11.4, 18.10.7 – Immediate Upgrade Required
GitLab released critical security patches for CE and EE on May 27 2026. The update addresses a high‑severity improper access control flaw in Duo AI workflow runners that could allow unauthorized access and potential denial of service. All self‑managed installations should upgrade immediately; GitLab.com and Dedicated customers are already protected.
Read briefing
GitLab 18.3.1/18.2.5/18.1.5 Patch Addresses Medium‑Severity Resource Allocation Vulnerability
GitLab released patch versions 18.3.1, 18.2.5, and 18.1.5 on August 27, 2025 to fix a medium‑severity resource‑allocation flaw in the import function that could allow an attacker to exhaust system resources. All self‑managed CE and EE installations must upgrade immediately; GitLab.com and Dedicated customers are already protected.
Read briefing
Critical GitLab CE/EE Vulnerability (CVE-2026-97229) – Immediate Upgrade Required
An integer‑overflow flaw in GitLab’s CI/CD regex compiler (CVE‑2026‑97229) allows unauthenticated code execution on self‑managed instances. All GitLab Community and Enterprise Editions older than 19.4.2, 19.3.4, or 19.2.8 must be patched immediately, prioritizing internet‑facing deployments.
Read briefing
GitLab Urges Immediate Patch for CVE‑2026‑85706 Path Traversal Flaw – Attackers Already Scanning
GitLab has released critical security updates for two high‑severity bugs: CVE‑2026‑85706, an unauthenticated path traversal that can expose arbitrary files, and CVE‑2026‑87719, an insecure deserialization flaw that lets privileged users harvest credentials. The first flaw was discovered by researcher s3ntago via GitLab’s HackerOne program, and watchdog firm watchTowr reports attackers are already probing exposed instances. All self‑managed GitLab installations must upgrade to the patched 19.3.2/19.2.6/19.1 releases immediately. The platform serves over 30 million users, including more than 50%
Read briefing