On October 21, 2026, GitLab released versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13 for GitLab Community Edition (CE) and Enterprise Edition (EE). These versions contain important bug and security fixes, and GitLab strongly recommends that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated tenants running 19.3.5-internal0 and 19.4.2-internal0 or later already include these fixes and need not take action.
GitLab releases fixes for vulnerabilities in patch releases of two types: scheduled releases, issued twice a month on the second and fourth Wednesdays, and ad-hoc critical patches for high-severity vulnerabilities. Security issues are made public on the issue tracker 90 days after the release in which they were patched. GitLab states it is committed to the highest security standards for all aspects of the platform exposed to customers or hosting customer data.
The most serious fix addresses CVE-2026-110264, an integer overflow in the regular expression compiler. Under certain conditions it could allow an unauthenticated user to execute arbitrary code on the GitLab server. It carries a CVSS score of 10.0, and was reported through HackerOne's bug bounty program. The fix was backported to versions 18.11.13, 19.0.10, 19.1.9 and 19.2.9.
Another fix, CVE-2026-15723, addresses an improper authentication issue. When OmniAuth SAML and LDAP auto-linking were both enabled, an authenticated user could take over an existing LDAP-backed account without any interaction from the target, with a CVSS score of 8.2. Affected versions span 10.1 through 19.5 before the patched releases. GitLab also released two threat detections for self-managed instances to help identify exploitation attempts. GitLab-managed infrastructure, including GitLab.com and GitLab Dedicated, remains patched.
Source: Hacker News · Summarized by HeadlinesBriefing