GitLab Patch Release: 18.11.1, 18.10.4, 18.9.6 | GitLab Docs

GitLab released patch versions 18.11.1, 18.10.4, and 18.9.6 on April 22, 2026, addressing multiple security vulnerabilities and bugs in CE and EE. Self-managed installations should upgrade immediately, while GitLab.com is already patched and GitLab Dedicated customers need no action. The fixes include unauthenticated GraphQL and browser-based attacks, several denial-of-service flaws, and access-control weaknesses.

Release Scope and Upgrade Guidance

• Applies to GitLab Community Edition and Enterprise Edition.
• Affects all deployment types unless otherwise specified, including Omnibus, source installations, and Helm charts.
• Recommended fixed versions:
  • 18.11.1
  • 18.10.4
  • 18.9.6
• GitLab issues detailing security vulnerabilities are made public 30 days after the relevant patch release.
• GitLab publishes both scheduled patch releases, issued on the second and fourth Wednesdays, and ad-hoc critical patches for high-severity vulnerabilities.

High-Severity Vulnerabilities

• CVE-2026-4922 — GraphQL CSRF

  • CVSS 8.1.
  • An unauthenticated attacker could execute GraphQL mutations on behalf of an authenticated user because of insufficient CSRF protection.
  • Affects versions before 18.9.6, 18.10.4, and 18.11.1.

• CVE-2026-5816 — Web IDE path validation

  • CVSS 8.0.
  • Under certain conditions, improper path validation could allow unauthenticated attackers to execute arbitrary JavaScript in a user’s browser session.
  • Affects the 18.10 and 18.11 release lines before the listed patches.

• CVE-2026-5262 — Storybook cross-site scripting

  • CVSS 8.0.
  • Improper input validation could allow unauthenticated access to tokens in the Storybook development environment.
  • Affects versions from 16.1 through the unpatched 18.9, 18.10, and 18.11 releases.

Denial-of-Service Fixes

• CVE-2025-0186: Crafted requests to the discussions endpoint could exhaust server resources.
• CVE-2026-1660: Improper input validation during Jira issue imports could enable resource exhaustion.
• CVE-2025-6016: Insufficient limits when retrieving notes could cause service disruption.
• CVE-2025-3922: Resource-allocation weaknesses in the GraphQL API could allow authenticated users to overwhelm the system.
• Each issue carries a CVSS score of 6.5 and generally requires authentication.

Access-Control and Session Fixes

• CVE-2026-6515 — Virtual registry credentials

  • CVSS 5.4.
  • Invalidated or incorrectly scoped credentials could continue accessing Virtual Registries.

• CVE-2026-5377 — Confidential issue titles

  • CVSS 4.3.
  • Authenticated users could potentially view titles of confidential or private issues in public projects.

• CVE-2026-3254 — Mermaid sandbox

  • CVSS 3.5.
  • Improper validation could allow authenticated users to load unauthorized content into another user’s browser.

• The release also lists CVE-2025-9957, involving improper access control in the project fork relationship API; the provided text does not include its full impact or severity details.

Self-managed GitLab administrators should apply the appropriate patch release as soon as possible, especially because several vulnerabilities permit unauthenticated browser or API attacks.