OFICIAL GitLab Blog

GitLab Critical Patch Release: 19.2.4, 19.1.6, 19.0.8, 18.11.11

What happened
Based on GitLab Blog · Aug 17, 2026

GitLab issued critical security patches on August 17, 2026, addressing two high-severity vulnerabilities that could allow unauthenticated remote modification or deletion of public projects and data via GraphQL directives.

🚩 Report a correction ↗ Open source
Key points
·
On August 17, 2026, we released versions 19.2.4, 19.1.6, 19.0.8, 18.11.11 for GitLab Community Edition (CE) and Enterprise Edition (EE).
·
These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately.
·
GitLab.com and GitLab Dedicated are already running the patched version.
·
GitLab.com and GitLab Dedicated customers do not need to take action.
Key numbers
·
Vulnerability details will be publicly disclosed on GitLab’s issue tracker 90 days after the release date.

GitLab released versions 19.2.4, 19.1.6, 19.0.8, and 18.11.11 on August 17, 2026, for both Community Edition and Enterprise Edition. These updates include critical bug fixes and security patches, with GitLab strongly advising all self-managed installations to upgrade immediately. GitLab.com and GitLab Dedicated users are unaffected as they already run the patched versions. The company notes that patch releases address vulnerabilities and are issued either on schedule or as ad-hoc critical patches for high-severity issues.

The first vulnerability, reported by hiimguardian via HackerOne, allowed unauthenticated users to remotely modify or delete public projects and user data under specific conditions using a GraphQL directive. The second issue, reported by kreep, permitted unauthenticated users to execute mutations via GET requests due to improper request validation in GraphQL multiplex query handling. Both vulnerabilities carry a CVSS score of 9.4, indicating critical severity.

The patched versions do not introduce new database migrations and are designed to minimize downtime for multi-node deployments. Omnibus package upgrades will automatically stop, run migrations, and restart GitLab, though this behavior can be modified by creating a /etc/gitlab/skip-auto-reconfigure file for updates only. Users are directed to the Update page for GitLab and the Updating the Runner page for GitLab Runner instructions.

GitLab emphasizes maintaining strong security practices by upgrading to the latest patch release for supported versions. The company commits to high security standards for all aspects exposed to customers or hosting customer data. Vulnerability details will be publicly disclosed on GitLab’s issue tracker 90 days after the release date.

Original source → Deals on Clipraptor.com →