GitLab Patch Release: 19.0.1, 18.11.4, 18.10.7 | GitLab Docs (opens in new tab)
GitLab released patch versions 19.0.1, 18.11.4, and 18.10.7 on May 27, 2026, addressing multiple security vulnerabilities and bug fixes across CE and EE. The most serious issue, rated CVSS 8.2, affected Duo AI workflow identity resolution, while other fixes addressed authorization, data exposure, denial-of-service, and CI access issues. GitLab strongly recommends that self-managed installations upgrade immediately. ## Release Scope and Upgrade Guidance - Applies to GitLab Community Edition and Enterprise Edition. - GitLab.com is already patched; GitLab Dedicated customers do not need to act. - The releases include fixes for supported versions and should be applied as soon as possible. - GitLab publishes vulnerability details publicly 30 days after the release containing the fix. - Patch releases are generally issued on the second and fourth Wednesdays, with critical ad-hoc releases possible. ## Security Fixes - **CVE-2026-4868 — Duo AI workflow runners, EE** - CVSS 8.2. - Under certain conditions, an authenticated user could cause workflows to run under another user’s identity. - Affected versions were EE releases before 18.10.7, 18.11.4, and 19.0.1. - **CVE-2026-1402 — Wiki denial of service, CE/EE** - CVSS 6.5. - Insufficient validation could allow an authenticated user to trigger a denial-of-service condition. - **CVE-2026-6713 — GraphQL WorkItem API, CE/EE** - CVSS 5.3. - Incorrect authorization checks could allow unauthorized enumeration of private projects. - **CVE-2026-5296 — Duo Workflows API, EE** - CVSS 4.3. - Developer-level users could bypass restrictions on group-level foundational flows in certain configurations. - **CVE-2026-2601 — Operations, EE** - CVSS 4.3. - Developers could potentially access sensitive deployment data because of missing authorization checks. - **CVE-2026-8716 — Pipelines, CE/EE** - CVSS 4.3. - Incorrect name resolution could expose CI data from an unintended ref type. - **CVE-2026-2710 — Authentication endpoints, CE/EE** - CVSS 4.3. - Blocked project access tokens could continue accessing private resources in certain cases. ## Bug Fixes in 19.0.1 - Added write permissions for repositories in job-token fine-grained permissions. - Fixed broken trial calls to action on the self-managed GitLab Credits dashboard. - Updated API security remediation guidance. - Removed Helm-based release-environment QA coverage. - Backported final 19.0 release notes and related maintenance changes. ## Bug Fixes in 18.11.4 - Updated Ruby thread scheduler behavior and Zlib to version 3.2.3. - Upgraded GitLab Shell to 14.50.0 and Elasticsearch indexer to 5.14.7. - Fixed lost comments when moving wiki pages. - Improved subgroup provisioning, synchronization workers, pipeline cancellation, and build handling. - Corrected issues affecting swimlanes, epic boards, CI catalog filtering, and pipeline traces. - Improved advanced-search bulk indexing by using the primary database connection. - Added AI workflow scope support and endpoint handling for diagram proxies. - Included performance optimizations for license approval workflows. ## Recommended Action Administrators of affected self-managed GitLab installations should upgrade to 19.0.1, 18.11.4, or 18.10.7 immediately, using the appropriate deployment method such as Omnibus, source, or Helm.