GitLab Patch Release: 19.3.1, 19.2.5, 19.1.7

On August 26, 2026, we released versions 19.3.1, 19.2.5, 19.1.7 for GitLab Community Edition (CE) and Enterprise Edition (EE).

These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action.

GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases: scheduled releases and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays. For more information, please visit our releases handbook and security FAQ. You can see all of GitLab release blog posts here.

For security fixes, the issues detailing each vulnerability are made public on our issue tracker 90 days after the release in which they were patched.

We are committed to ensuring that all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. To maintain good security hygiene, it is highly recommended that all customers upgrade to the latest patch release for their supported version. You can read more best practices in securing your GitLab instance in our blog post.

Recommended Action

We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible.

When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, it means all types are affected.

Security fixes

Table of security fixes

CVE-2026-18252 - Inclusion of Functionality from Untrusted Control Sphere issue in Duo Claude AI agent impacts GitLab EE

GitLab has remediated an issue that, under certain conditions, an authenticated user with developer-role permissions could have executed arbitrary commands in a CI context, due to the Claude agent processing configuration from a user-controlled source.

Impacted Versions: GitLab EE: all versions from 18.9 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1
CVSS 8.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N)

Thanks thwin_htet for reporting this vulnerability through our HackerOne bug bounty program

CVE-2026-77801 - Denial of Service issue in import pipeline impacts GitLab CE/EE

GitLab has remediated an issue that, under certain conditions, an authenticated user could have caused denial of service affecting background job processing, due to missing object count limits.

Impacted Versions: GitLab CE/EE: all versions from 12.8 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1
CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Thanks Tran Ba Quang for reporting this vulnerability

CVE-2025-10903 - Denial of Service issue in SCIM API impacts GitLab EE

GitLab has remediated an issue that, under certain conditions, an authenticated user could have caused denial of service, due to an unbounded loop triggered by specially crafted input in the SCIM user provisioning feature.

Impacted Versions: GitLab EE: all versions from 11.10 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1
CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Thanks rafabd1 for reporting this vulnerability through our HackerOne bug bounty program

CVE-2026-3035 - Improper Access Control issue in protected environments impacts GitLab EE

GitLab has remediated an issue that, under certain conditions, an authenticated user with project Maintainer permissions could have accessed the terminal of a protected environment they were not authorized to use due to improper authorization checks.

Impacted Versions: GitLab EE: all versions from 11.3 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1
CVSS 5.5 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N)

Thanks go7f0 for reporting this vulnerability through our HackerOne bug bounty program

CVE-2026-4398 - Authorization Bypass issue in compliance framework assignment impacts GitLab EE

GitLab has remediated an issue that, under certain conditions, an authenticated user could have assigned compliance frameworks from namespaces they were not authorized to access to their own project, due to missing namespace validation on self-managed instances.

Impacted Versions: GitLab EE: all versions from 18.3 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1
CVSS 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)

Thanks bountyyfi for reporting this vulnerability through our HackerOne bug bounty program

CVE-2026-15387 - Improper Handling of Untrusted Data issue in Pipeline Execution Policies impacts GitLab EE

GitLab has remediated an issue that, under certain conditions, an authenticated user with developer-role permissions could have influenced the execution environment of Pipeline Execution Policy enforcement jobs, due to improper handling of job dependencies.

Impacted Versions: GitLab EE: all versions from 19.1 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1
CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)

Thanks 3nvz for reporting this vulnerability through our HackerOne bug bounty program

CVE-2026-7487 - Improper Authorization issue in merge request approval rules reset impacts GitLab EE

GitLab has remediated an issue that, under certain conditions, an authenticated user with reporter-role permissions who authored a merge request could have reset merge request approval rules due to improper authorization checks.

Impacted Versions: GitLab EE: all versions from 13.1 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1
CVSS 3.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N)

Thanks rogerace for reporting this vulnerability through our HackerOne bug bounty program

Bug fixes

19.3.1

• Backport ‘Provision inherited foundational flows without user elevation’ to 19-3-stable-ee
• Backport 19.3 release notes to 19-3-stable-ee
• Backport of “Fix MCP OAuth Protected Resource Metadata resource field to return string instead of array”
• Backport of “Gate tracked ref filter on advanced vulnerability management”
• Backport of ‘Reorder deployments bigint cleanup so the FK sorts first’
• Backport of 19.3 release note correction - redesigned agentic chat UI release post

19.2.5

• Backport of ‘Fix broken master by making tests date-independent’
• Backport of: Install glab from official GitLab releases instead of third-party mirror
• Backport of ‘Add import_jobs_concurrency_limit to application settings’
• Backport of Fix infinite loop parsing errored SARIF security reports (19.2)
• Backport of ‘Preserve email reply content after lone bullet lines’
• Release post backport: Add dedicated-hosted-ai-gateway release note to 19-2-stable-ee
• Backport: Add dedicated_self_hosted_models.md to 19.2
• Backport of “Fix MCP OAuth Protected Resource Metadata resource field to return string instead of array”
• Backport of ‘Fix order-dependent epic import gap’
• Backport of Fix drop_ai_* tables migrations
• Backport of “Send Duo availability params only when changed” (19.2)
• [19.2] Backport fixes for Mattermost deprecation
• Bump gitlab-omnibus-builder version to 5.63.1

19.1.7

• Backport of: Install glab from official GitLab releases instead of third-party mirror
• Backport of ‘Add import_jobs_concurrency_limit to application settings’
• Backport of Fix infinite loop parsing errored SARIF security reports (19.1)
• Backport of ‘Preserve email reply content after lone bullet lines’
• Backport of ‘Avoid unbounded preload in any_merge_request rules sync’
• Backport of “Send Duo availability params only when changed” (19.1)
• [19.1] Backport fixes for Mattermost deprecation

Important notes on upgrading

This patch includes database migrations that may impact your upgrade process.

Impact on your installation:

• Single-node instances: This patch will cause downtime during the upgrade as migrations must complete before GitLab can start.
• Multi-node instances: With proper zero-downtime upgrade procedures, this patch can be applied without downtime.

Regular migrations

The following versions include regular migrations that run during the upgrade process:

• 19.3.1
• 19.2.5
• 19.1.7

Post-deploy migrations

The following versions include post-deploy migrations that can run after the upgrade:

• 19.3.1
• 19.2.5

To learn more about the impact of upgrades on your installation, see:

• Zero-downtime upgrades for multi-node deployments
• Standard upgrades for single-node installations

Updating

To update GitLab, see the Update page. To update GitLab Runner, see the Updating the Runner page.

Receive Patch Notifications

To receive patch blog notifications delivered to your inbox, visit our contact us page. To receive release notifications via RSS, subscribe to our patch release RSS feed or our RSS feed for all releases.