techlist.io
KREN
gitlab

GitLab Patch Release: 19.1.1, 19.0.3, 18.11.6 | GitLab Docs (opens in new tab)

gitlabci-cdapi-securitycross-site-scriptingauthorizationdasthackeronemaven-package-registry

GitLab released patch versions 19.1.1, 19.0.3, and 18.11.6 on June 24, 2026, addressing important bugs and security vulnerabilities in CE and EE. Self-managed installations should upgrade immediately; GitLab.com is already patched, and GitLab Dedicated customers need no action. The release fixes issues ranging from cross-site scripting and information disclosure to authorization bypasses and improper access controls.

Release Guidance

  • The patches apply to GitLab Community Edition and Enterprise Edition.
  • GitLab recommends upgrading all affected self-managed installations to the latest supported patch release.
  • GitLab publishes scheduled patch releases twice monthly, with additional critical releases when necessary.
  • Vulnerability details are generally made public 30 days after the fixing release.
  • Unless otherwise specified, all deployment types—including Omnibus, source installations, and Helm charts—are affected.

High-Severity Cross-Site Scripting Vulnerabilities

  • CVE-2026-10086 — Analytics Dashboard

    • A developer-level authenticated user could execute arbitrary client-side code in another user’s session through insufficient input sanitization.
    • Affects GitLab EE versions before 18.11.6, 19.0.3, and 19.1.1.
    • CVSS: 8.7

  • CVE-2026-10712 — Web IDE Workbench Asset Handler

    • Improper path validation could allow an unauthenticated attacker to execute JavaScript in a victim’s browser session.
    • Affects CE and EE versions before 18.11.6, 19.0.3, and 19.1.1.
    • CVSS: 8.0

Information Disclosure and Authorization Issues

  • CVE-2026-12053 — Duo Workflows

    • Insufficient output filtering could expose sensitive information previously committed to a project.
    • Affects GitLab EE 19.1 versions before 19.1.1.
    • CVSS: 7.7

  • CVE-2026-5309 — Virtual Registry Cleanup Policy API

    • Authenticated users could read or modify another group’s cleanup policy settings.
    • Affects EE versions before 18.11.6, 19.0.3, and 19.1.1.
    • CVSS: 5.4

  • CVE-2026-2238 — Rapid Diffs

    • Unauthenticated users could view confidential issue references on public projects.
    • Affects CE and EE versions before 18.11.6, 19.0.3, and 19.1.1.
    • CVSS: 5.3

  • CVE-2026-11379 — DAST Site Profile Management

    • Developer-level users could potentially extract DAST site profile secrets due to incorrect authorization.
    • Affects EE versions before 18.11.6, 19.0.3, and 19.1.1.
    • CVSS: 5.3

Additional Security Fixes

  • CVE-2026-8330 — CI/CD API

    • Sensitive data could be written to application logs because of insufficient filtering.
    • CVSS: 4.4

  • CVE-2026-1606 — Snippets

    • Authenticated users could conceal content within snippets through improper input validation.
    • CVSS: 4.3

  • CVE-2026-5952 — Maven Package Registry

    • Developers could bypass package protection rules and overwrite protected Maven package metadata.
    • CVSS: 4.3

  • CVE-2026-5796 — Group Packages API

    • Reporters could view package metadata from projects where the Package Registry was disabled.
    • CVSS: 4.3

Recommended Action

Administrators of affected self-managed GitLab instances should upgrade to 18.11.6, 19.0.3, or 19.1.1, depending on their supported release branch, as soon as possible. Updating promptly is particularly important because several vulnerabilities permit code execution, sensitive-data exposure, or unauthorized access.