GitLab Patch Release: 18.10.3, 18.9.5, 18.8.9 | GitLab Docs

GitLab released patch versions 18.10.3, 18.9.5, and 18.8.9 on April 8, 2026, addressing important security and bug fixes. Self-managed CE and EE installations should upgrade immediately, while GitLab.com is already patched and GitLab Dedicated customers need no action. The fixes cover unauthorized access, denial-of-service vulnerabilities, code injection, XSS, and information disclosure.

Release Scope and Upgrade Guidance

• The patches apply to GitLab Community Edition and Enterprise Edition.
• Administrators should upgrade installations affected by the listed vulnerabilities to the latest supported patch release.
• GitLab issues describing security vulnerabilities will become public 30 days after the release in which they were fixed.
• Patch releases are generally issued on the second and fourth Wednesdays, with urgent ad-hoc releases for critical vulnerabilities.

Authentication and Authorization Fixes

• CVE-2026-5173 (CVSS 8.5): Authenticated users could invoke unintended server-side methods through WebSocket connections.
• CVE-2026-2619 (CVSS 4.3): Auditor users could modify vulnerability flag data in private projects through the AI detection API.
• CVE-2026-1752 (CVSS 4.3): Developers could modify protected environment settings through authorization flaws in the Environments API.
• CVE-2026-2104: CSV exports could expose confidential issues assigned to other users because of insufficient authorization checks.

Denial-of-Service Vulnerabilities

• CVE-2026-1092 (CVSS 7.5): Unauthenticated attackers could crash or disrupt services through malformed JSON sent to the Terraform state lock API.
• CVE-2025-12664 (CVSS 7.5): Repeated unauthenticated GraphQL queries could cause denial of service.
• CVE-2026-1403 (CVSS 6.5): Authenticated users could disrupt Sidekiq workers by importing malformed CSV files.
• CVE-2026-1101 (CVSS 6.5): Authenticated users could overload GitLab through improperly validated GraphQL SBOM queries.

Code Execution and Cross-Site Scripting

• CVE-2026-1516 (CVSS 5.7): Crafted Code Quality report content could leak the IP addresses of users viewing the report.
• CVE-2026-4332 (CVSS 5.4): Authenticated users could execute arbitrary JavaScript in other users’ browsers through customizable analytics dashboards.

Information Disclosure

• CVE-2025-9484 (CVSS 4.3): Certain GraphQL queries could reveal other users’ email addresses to authenticated users.
• The release also fixes CSV export authorization issues that could expose confidential issue data.

Administrators of self-managed GitLab CE or EE instances should apply 18.10.3, 18.9.5, or 18.8.9 as soon as possible, depending on their supported release branch.