GitLab Patch Release: 19.2.2, 19.1.4, 19.0.6 | GitLab Docs

GitLab released patch versions 19.2.2, 19.1.4, and 19.0.6 on August 12, 2026, addressing multiple security and bug issues in CE and EE. The release fixes vulnerabilities involving cross-site scripting, authorization bypasses, privilege escalation, data exposure, and denial of service. Self-managed installations should upgrade immediately; GitLab.com is already patched, and GitLab Dedicated customers need no action.

Release Scope and Upgrade Guidance

• The patches apply to GitLab Community Edition and Enterprise Edition.
• GitLab recommends upgrading all affected self-managed installations to the latest patch for their supported release line.
• Patch releases may be scheduled or issued ad hoc for critical vulnerabilities.
• Security issues are generally disclosed publicly 90 days after the release containing their fixes.
• Unless a deployment type is explicitly excluded, omnibus, source, Helm chart, and other installation types are affected.

Cross-Site Scripting Vulnerabilities

• CVE-2026-15217 affects Analytics Dashboards table field configuration.
  • Improper neutralization of user-controlled values could allow XSS in table cell content.
  • CVSS: 8.7.
• CVE-2026-15216 affects Analytics Dashboards pagination controls.
  • User-controlled data could be rendered unsafely and enable XSS.
  • CVSS: 8.7.
• CVE-2026-16627 affects the CI manual job confirmation modal.
  • Authenticated developers could potentially escalate privileges through unsanitized HTML.
  • CVSS: 7.7.

Authorization and Privilege Issues

• CVE-2026-15423 affects the CI/CD pipeline API.
  • Developer-role users could run pipelines on protected branches without the required push permissions.
  • CVSS: 8.5.
• CVE-2026-19228 affects the Duo Workflow Service in GitLab EE.
  • An authenticated user could attribute AI usage to another namespace.
  • CVSS: 8.5.
• CVE-2026-16494 affects the EE ProjectsController.
  • Missing checks could let authenticated users modify project settings reserved for higher-privileged roles.
  • CVSS: 7.1.
• CVE-2026-8667 affects the npm distribution-tags endpoint.
  • Developers could modify certain package registry metadata without maintainer permissions.
  • CVSS: 4.3.

Information Disclosure and API Access

• CVE-2026-6821 affects the EE merge requests API.
  • Authenticated users could bypass IP-based restrictions and read limited merge request information from private projects.
  • CVSS: 4.3.
• CVE-2026-4879 affects the external status check API.
  • Developers could view status check configuration restricted to higher-privileged roles.
  • CVSS: 4.3.

Denial of Service

• CVE-2026-7427 affects the GraphQL API JSON parser.
  • Improper input validation could allow unauthenticated attackers to cause a denial of service.
  • CVSS: 5.3.

Self-managed GitLab administrators should apply 19.2.2, 19.1.4, or 19.0.6 immediately, depending on their release branch, to receive these security fixes.