techlist.io
KR EN
gitlab

GitLab Patch Release: 19.2.2, 19.1.4, 19.0.6 | GitLab Docs (opens in new tab)

gitlabci-cdgraphqlnpmapi-securitycross-site-scriptingauthorization

GitLab released patch versions 19.2.2, 19.1.4, and 19.0.6 on August 12, 2026, addressing multiple security and bug issues in CE and EE. The release fixes vulnerabilities involving cross-site scripting, authorization bypasses, privilege escalation, data exposure, and denial of service. Self-managed installations should upgrade immediately; GitLab.com is already patched, and GitLab Dedicated customers need no action.

Release Scope and Upgrade Guidance

  • The patches apply to GitLab Community Edition and Enterprise Edition.
  • GitLab recommends upgrading all affected self-managed installations to the latest patch for their supported release line.
  • Patch releases may be scheduled or issued ad hoc for critical vulnerabilities.
  • Security issues are generally disclosed publicly 90 days after the release containing their fixes.
  • Unless a deployment type is explicitly excluded, omnibus, source, Helm chart, and other installation types are affected.

Cross-Site Scripting Vulnerabilities

  • CVE-2026-15217 affects Analytics Dashboards table field configuration.
    • Improper neutralization of user-controlled values could allow XSS in table cell content.
    • CVSS: 8.7.
  • CVE-2026-15216 affects Analytics Dashboards pagination controls.
    • User-controlled data could be rendered unsafely and enable XSS.
    • CVSS: 8.7.
  • CVE-2026-16627 affects the CI manual job confirmation modal.
    • Authenticated developers could potentially escalate privileges through unsanitized HTML.
    • CVSS: 7.7.

Authorization and Privilege Issues

  • CVE-2026-15423 affects the CI/CD pipeline API.
    • Developer-role users could run pipelines on protected branches without the required push permissions.
    • CVSS: 8.5.
  • CVE-2026-19228 affects the Duo Workflow Service in GitLab EE.
    • An authenticated user could attribute AI usage to another namespace.
    • CVSS: 8.5.
  • CVE-2026-16494 affects the EE ProjectsController.
    • Missing checks could let authenticated users modify project settings reserved for higher-privileged roles.
    • CVSS: 7.1.
  • CVE-2026-8667 affects the npm distribution-tags endpoint.
    • Developers could modify certain package registry metadata without maintainer permissions.
    • CVSS: 4.3.

Information Disclosure and API Access

  • CVE-2026-6821 affects the EE merge requests API.
    • Authenticated users could bypass IP-based restrictions and read limited merge request information from private projects.
    • CVSS: 4.3.
  • CVE-2026-4879 affects the external status check API.
    • Developers could view status check configuration restricted to higher-privileged roles.
    • CVSS: 4.3.

Denial of Service

  • CVE-2026-7427 affects the GraphQL API JSON parser.
    • Improper input validation could allow unauthenticated attackers to cause a denial of service.
    • CVSS: 5.3.

Self-managed GitLab administrators should apply 19.2.2, 19.1.4, or 19.0.6 immediately, depending on their release branch, to receive these security fixes.