On April 22, 2026, we released versions 18.11.1, 18.10.4, 18.9.6 for GitLab Community Edition (CE) and Enterprise Edition (EE).

These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action.

GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases: scheduled releases and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays. For more information, please visit our releases handbook and security FAQ. You can see all of GitLab release blog posts here.

For security fixes, the issues detailing each vulnerability are made public on our issue tracker 30 days after the release in which they were patched.

We are committed to ensuring that all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. To maintain good security hygiene, it is highly recommended that all customers upgrade to the latest patch release for their supported version. You can read more best practices in securing your GitLab instance in our blog post.

Recommended Action

We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible.

When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, it means all types are affected.

Security fixes

Table of security fixes

CVE-2026-4922 - Cross-Site Request Forgery issue in GraphQL API impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed an unauthenticated user to execute GraphQL mutations on behalf of authenticated users due to insufficient CSRF protection.

Impacted Versions: GitLab CE/EE: all versions from 17.0 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1
CVSS 8.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N)

Thanks ahacker1 for reporting this vulnerability through our HackerOne bug bounty program

CVE-2026-5816 - Improper Resolution of Path Equivalence issue in Web IDE asset impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed an unauthenticated user to execute arbitrary JavaScript in a user’s browser session due to improper path validation under certain conditions.

Impacted Versions: GitLab CE/EE: all versions from 18.10 before 18.10.4 and 18.11 before 18.11.1
CVSS 8.0 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N)

Thanks joaxcar for reporting this vulnerability through our HackerOne bug bounty program

CVE-2026-5262 - Cross-site Scripting issue in Storybook impacts GitLab CE/EE

GitLab has remediated an issue that under certain conditions could have allowed an unauthenticated user to access tokens in the Storybook development environment due to improper input validation.

Impacted Versions: GitLab CE/EE: all versions from 16.1 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1
CVSS 8.0 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N)

Thanks joaxcar for reporting this vulnerability through our HackerOne bug bounty program

CVE-2025-0186 - Denial of Service issue in discussions endpoint impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed an authenticated user to cause denial of service under certain conditions by exhausting server resources by making crafted requests to a discussions endpoint.

Impacted Versions: GitLab CE/EE: all versions from 10.6 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1
CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Thanks pwnie for reporting this vulnerability through our HackerOne bug bounty program

CVE-2026-1660 - Denial of Service issue in Jira import impacts GitLab CE/EE

GitLab has remediated an issue that under certain conditions could have allowed an authenticated user to cause denial of service when importing issues due to improper input validation.

Impacted Versions: GitLab CE/EE: all versions from 12.3 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1
CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Thanks a92847865 for reporting this vulnerability through our HackerOne bug bounty program

CVE-2025-6016 - Denial of Service issue in notes endpoint impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed an authenticated user to cause denial of service due to insufficient resource allocation limits when retrieving notes under certain conditions.

Impacted Versions: GitLab CE/EE: all versions from 9.2 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1
CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Thanks pwnie for reporting this vulnerability through our HackerOne bug bounty program

CVE-2025-3922 - Denial of Service issue in GraphQL API impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed an authenticated user to cause denial of service by overwhelming system resources under certain conditions due to insufficient resource allocation limits in the GraphQL API.

Impacted Versions: GitLab CE/EE: all versions from 12.4 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1
CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Thanks pwnie for reporting this vulnerability through our HackerOne bug bounty program

CVE-2026-6515 - Insufficient Session Expiration issue in virtual registry credentials validation impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed a user to use invalidated or incorrectly scoped credentials to access Virtual Registries under certain conditions.

Impacted Versions: GitLab CE/EE: all versions from 18.2 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1
CVSS 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)

This vulnerability has been discovered internally by GitLab team member David Fernandez

CVE-2026-5377 - Improper Access Control issue in issue description renderer impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed an authenticated user to access titles of confidential or private issues in public projects due to improper access control in the issue description rendering process.

Impacted Versions: GitLab CE/EE: all versions from 18.11 before 18.11.1
CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

Thanks yvvdwf for reporting this vulnerability through our HackerOne bug bounty program

CVE-2026-3254 - Improper Restriction of Rendered UI Layers or Frames issue in Mermaid sandbox impacts GitLab CE/EE

GitLab has remediated an issue that under certain conditions could have allowed an authenticated user to load unauthorized content into another user’s browser due to improper input validation in the Mermaid sandbox.

Impacted Versions: GitLab CE/EE: all versions from 18.11 before 18.11.1
CVSS 3.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N)

Thanks joaxcar for reporting this vulnerability through our HackerOne bug bounty program

CVE-2025-9957 - Improper Access Control issue in project fork relationship API impacts GitLab CE/EE

GitLab has remediated an issue that under certain conditions could have allowed an authenticated user with project owner permissions to bypass group fork prevention settings due to improper authorization checks.

Impacted Versions: GitLab CE/EE: all versions from 11.2 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1
CVSS 2.7 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N)

Thanks theluci for reporting this vulnerability through our HackerOne bug bounty program

Bug fixes

18.11.1

• Backport- Use force_index_repo task type for Zoekt schema_version bump reindexing
• Backport docs: Update PostgreSQL version documentation for PG17
• [18.11] Skip re-creating of constraint when migration spec is skipped
• Backport of " 18.11 What’s new"
• Revert “Merge branch ‘renovate-ci-templates/auto-build-image-4.x’ into ‘v18.11.0-ee’”
• Backport of “BBM - Skip 3 migrations referencing dropped tables”
• [18.11] Fix session ID dropdown never appearing during active agentic chat
• Backport of ‘Fix JSON tables with non-string values’
• 18.11 - Cherry-pick !9288 and !9311 - Remove PackageCloud CI and rename pulp jobs
• Backport of ‘Remove package OS check from deployer task’ - 18.11

18.10.4

• [18.10] Scope start-rails-specs changes rule to MR pipelines
• Backport of ‘Fix runner token reset returning 500 for unassigned project runners’ to 18.10
• Backport of ‘Fix flaky new_project_spec.rb by scoping within pane’
• 18.10 Backport of ‘Update rack to 2.2.23’
• Backport of “Skip BBMs referencing dropped tables in single-record bug retry”
• Backport of Added reload to address flaky pipeline spec race condition
• Backport GITLAB_ZOEKT_INDEXER v1.11.1
• Backport of Fix flaky tests for ui_variable_non_inheritable_when_forward_pipeline_variables_false_spec
• Backport of ‘Skip CI finished builds backfill when ClickHouse is not configured’
• Backport to 18.10: Geo: Run concurrency limit worker on secondary sites
• Backport of ‘Geo: Switch blob download to use GitLab::HTTP to avoid llhttp-ffi issue’
• Backport of Release environment deploy needs Omnibus package - 18.10
• Backport- Use force_index_repo task type for Zoekt schema_version bump reindexing
• Backport of add feature flag to gate default Sidekiq concurrency limit calculation
• [18.10] Skip re-creating of constraint when migration spec is skipped
• Docs backport: Add note about Agent Platform flow configurations not available until 18.11
• Backport of praba/release-connections-from-all-hosts and stomlinson/feature-check-dead-connections to 18.10
• Backport to 18.10: Geo: Fix site validation when outbound request filtering is enabled
• Ensure postgresql_new is included in GitLab CE
• 18.10 backport of ‘Update rack to 2.2.23’
• Upgrade postgresql-17 to 17.8 for 18-10-stable
• Upgrade postgresql-16 to 16.13 for 18-10-stable
• Backport: fix: Set sv timeout when restarting Gitaly to 18.10
• [18.10] Remove Mattermost for SLES-12.5
• 18.10 - Cherry-pick !9288 and !9311 - Remove PackageCloud CI and rename pulp jobs
• Backport of ‘Remove package OS check from deployer task’ - 18.10

18.9.6

• chore: bump gitlab-zoekt to v1.8.2 on 18-9-stable
• [18.9] Scope start-rails-specs changes rule to MR pipelines
• 18.9 Backport of ‘update zlib to 3.2.3’
• Backport to 18.9: Geo: Run concurrency limit worker on secondary sites
• Backport of Release environment deploy needs Omnibus package - 18.9
• Backport- Use force_index_repo task type for Zoekt schema_version bump reindexing
• [18.9] Skip re-creating of constraint when migration spec is skipped
• Docs backport: Add note about Agent Platform flow configurations not available until 18.11
• Backport of add feature flag to gate default Sidekiq concurrency limit calculation
• Backport GITLAB_ZOEKT_INDEXER v1.8.2
• Backport to 18.9: Geo: Fix site validation when outbound request filtering is enabled
• Backport: Ensure postgresql_new is included in GitLab CE
• 18.9 backport of ‘Update rack to 2.2.23’
• Upgrade postgresql-17 to 17.8 for 18-9-stable
• Upgrade postgresql-16 to 16.13 for 18-9-stable
• Backport: fix: Set sv timeout when restarting Gitaly to 18.9
• [18.9] Remove Mattermost for SLES-12.5
• 18.9 - Cherry-pick !9288 and !9311 - Remove PackageCloud CI and rename pulp jobs
• Remove .gitlab folder under package gitlab-rails
• Backport of ‘Remove package OS check from deployer task’ - 18.9

Important notes on upgrading

This patch includes database migrations that may impact your upgrade process.

Impact on your installation:

• Single-node instances: This patch will cause downtime during the upgrade as migrations must complete before GitLab can start.
• Multi-node instances: With proper zero-downtime upgrade procedures, this patch can be applied without downtime.

Regular migrations

The following versions include regular migrations that run during the upgrade process:

• 18.11.1
• 18.10.4
• 18.9.6

Post-deploy migrations

The following versions include post-deploy migrations that can run after the upgrade:

• 18.11.1
• 18.10.4

To learn more about the impact of upgrades on your installation, see:

• Zero-downtime upgrades for multi-node deployments
• Standard upgrades for single-node installations

Updating

To update GitLab, see the Update page. To update GitLab Runner, see the Updating the Runner page.

Receive Patch Notifications

To receive patch blog notifications delivered to your inbox, visit our contact us page. To receive release notifications via RSS, subscribe to our patch release RSS feed or our RSS feed for all releases.

On April 8, 2026, we released versions 18.10.3, 18.9.5, 18.8.9 for GitLab Community Edition (CE) and Enterprise Edition (EE).

These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action.

GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases: scheduled releases and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays. For more information, please visit our releases handbook and security FAQ. You can see all of GitLab release blog posts here.

For security fixes, the issues detailing each vulnerability are made public on our issue tracker 30 days after the release in which they were patched.

We are committed to ensuring that all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. To maintain good security hygiene, it is highly recommended that all customers upgrade to the latest patch release for their supported version. You can read more best practices in securing your GitLab instance in our blog post.

Recommended Action

We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible.

When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, it means all types are affected.

Security fixes

Table of security fixes

CVE-2026-5173 - Exposed Method issue in websocket connections impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed an authenticated user to invoke unintended server-side methods through websocket connections due to improper access control.

Impacted Versions: GitLab CE/EE: all versions from 16.9.6 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3
CVSS 8.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N)

This vulnerability has been discovered internally by GitLab team member Simon Tomlinson

CVE-2026-1092 - Denial of Service issue in Terraform state lock API impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed an unauthenticated user to cause denial of service due to improper input validation of JSON payloads.

Impacted Versions: GitLab CE/EE: all versions from 12.10 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3
CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Thanks a92847865 for reporting this vulnerability through our HackerOne bug bounty program

CVE-2025-12664 - Denial of Service issue in GraphQL API impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed an unauthenticated user to cause denial of service by sending repeated GraphQL queries.

Impacted Versions: GitLab CE/EE: all versions from 13.0 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3
CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Thanks foxribeye for reporting this vulnerability through our HackerOne bug bounty program

CVE-2026-1403 - Denial of Service issue in CSV import impacts GitLab CE/EE

GitLab has remediated an issue that when importing CSV files could have allowed an authenticated user to cause denial of service to Sidekiq workers due to improper validation of CSV file structure.

Impacted Versions: GitLab CE/EE: all versions from 11.7 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3
CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Thanks a92847865 for reporting this vulnerability through our HackerOne bug bounty program

CVE-2026-1101 - Denial of Service issue in GraphQL SBOM API impacts GitLab EE

GitLab has remediated an issue that could have allowed an authenticated user to cause denial of service to the GitLab instance due to improper input validation in GraphQL queries.

Impacted Versions: GitLab EE: all versions from 18.2 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3
CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Thanks sim4n6 for reporting this vulnerability through our HackerOne bug bounty program

CVE-2026-1516 - Code Injection issue in Code Quality reports impacts GitLab EE

GitLab has remediated an issue that in Code Quality reports could have allowed an authenticated user to leak IP addresses of users viewing the report via specially crafted content.

Impacted Versions: GitLab EE: all versions from 18.0.0 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3
CVSS 5.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N)

Thanks maksyche for reporting this vulnerability through our HackerOne bug bounty program

CVE-2026-4332 - Cross-site Scripting issue in analytics dashboards impacts GitLab EE

GitLab has remediated an issue that, in customizable analytics dashboards, could have allowed an authenticated user to execute arbitrary JavaScript in the context of other users’ browsers due to improper input sanitization.

Impacted Versions: GitLab EE: all versions from 18.2 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3
CVSS 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)

Thanks go7f0 for reporting this vulnerability through our HackerOne bug bounty program

CVE-2026-2619 - Incorrect Authorization issue in vulnerability flags AI detection API impacts GitLab EE

GitLab has remediated an issue that under certain circumstances could have allowed an authenticated user with auditor privileges to modify vulnerability flag data in private projects due to incorrect authorization.

Impacted Versions: GitLab EE: all versions from 18.6 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3
CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)

Thanks sage_cyberlord for reporting this vulnerability through our HackerOne bug bounty program

CVE-2025-9484 - Information Disclosure issue in certain GraphQl query impacts GitLab EE

GitLab has remediated an issue that under certain circumstances could have allowed an authenticated user to have access to other users’ email addresses via certain GraphQL queries.

Impacted Versions: GitLab EE: all versions from 16.6 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3
CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

Thanks mateuszek for reporting this vulnerability through our HackerOne bug bounty program

CVE-2026-1752 - Improper Access Control issue in Environments API impacts GitLab EE

GitLab has remediated an issue that could have allowed an authenticated user with developer-role permissions to modify protected environment settings due to improper authorization checks in the API.

Impacted Versions: GitLab EE: all versions from 11.3 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3
CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)

Thanks modhanami for reporting this vulnerability through our HackerOne bug bounty program

CVE-2026-2104 - Information Disclosure issue in CSV export impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed an authenticated user to access confidential issues assigned to other users via CSV export due to insufficient authorization checks.

Impacted Versions: GitLab CE/EE: all versions from 18.2 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3
CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

Thanks ahacker1 for reporting this vulnerability through our HackerOne bug bounty program

CVE-2026-4916 - Missing Authorization issue in custom role permissions impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed an authenticated user with custom role permissions to demote or remove higher-privileged group members due to improper authorization checks on member management operations.

Impacted Versions: GitLab CE/EE: all versions from 18.2 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3
CVSS 2.7 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N)

Thanks theluci for reporting this vulnerability through our HackerOne bug bounty program

Bug fixes

18.10.3

• Fix regression: “Git operations for Deploy keys fail on a Geo Site”
• 18.10 Backport of ‘Stop archiving projects when marking for deletion’
• [18.10] Ignore Net::SMTPServerBusy errors in SLIs
• [Backport] Add improvements to migration helper so that the backfill migration completes faster
• [BACKPORT] Fix agentic flows for DAP self-hosted
• Backport of 594064-geo-handle-record-not-found-on-sync to 18.10
• [18.10] Fix AmazonLinux 2023 not working with epoll_pwait2 glibc call
• 18.10 - Stop uploading packages to PackageCloud
• Backport of Match MergeRequests::ApplicationController auth checks in MCP conflicts tool
• Backport of ‘Add null user guard to adjourned group deletion service’
• [18.10] Fix composite identity support for dependency proxy access
• [18.10] Revert “Merge branch ‘segregate-buildx-build-among-rails-ce-and-ee’ into ‘master’”
• chore: bump gitlab-zoekt to v1.11.1 on 18-10-stable
• Backport of Validate parallel:matrix expanded job name length
• Fix flaky spec in spec/requests/api/merge_requests_spec.rb
• Backport of Fix remaining failures in new_project_spec.rb after !228726
• Backport of ‘Fixes gitlab-rspec test failures on stable branches’
• Backport of ‘Upgrade http and llhttp-ffi’
• Backport ‘595107/fix-model-selection-ui-regression’ into 18.10
• [18.10] Remove me-south-1 region from AMI publishing list
• Backport 18.10: Do not include Spamcheck with the SLES12 package
• Backport 18-10: Set strategy:mirror to propagate downstream failure on check-packages-functionality trigger job

18.9.5

• Fix regression: “Git operations for Deploy keys fail on a Geo Site”
• 18.9 Backport of ‘Stop archiving projects when marking for deletion’
• [BACKPORT] Fix agentic flows for DAP self-hosted
• Backport of 594064-geo-handle-record-not-found-on-sync to 18.9
• [18.9] Fix AmazonLinux 2023 not working with epoll_pwait2 glibc call
• 18.9 - Stop uploading packages to PackageCloud
• [18.9] Fix composite identity support for dependency proxy access
• Fix flaky spec in spec/requests/api/merge_requests_spec.rb
• Backport of Fix remaining failures in new_project_spec.rb after !228726
• Backport ‘595107/fix-model-selection-ui-regression’ into 18.9
• [18.9] Remove me-south-1 region from AMI publishing list
• Backport 18.9: Do not include Spamcheck with the SLES12 package
• Backport 18-9: Set strategy:mirror to propagate downstream failure on check-packages-functionality trigger job

18.8.9

• Fix regression: “Git operations for Deploy keys fail on a Geo Site”
• 18.8 Backport of ‘Stop archiving projects when marking for deletion’
• Backport of 594064-geo-handle-record-not-found-on-sync to 18.8
• [BACKPORT] Fix agentic flows for DAP self-hosted
• 18.8 - Stop uploading packages to PackageCloud
• [18.8] Fix AmazonLinux 2023 not working with epoll_pwait2 glibc call
• Backport of Fix remaining failures in new_project_spec.rb after !228726
• Backport ‘595107/fix-model-selection-ui-regression’ into 18.8
• [18.8] Remove me-south-1 region from AMI publishing list
• Backport 18-8: Set strategy:mirror to propagate downstream failure on check-packages-functionality trigger job

Important notes on upgrading

These versions do not include any new migrations, and for multi-node deployments, should not require any downtime.

Please be aware that by default the Omnibus packages will stop, run migrations, and start again, no matter how “big” or “small” the upgrade is. This behavior can be changed by adding a /etc/gitlab/skip-auto-reconfigure file, which is only used for updates.

The SLES 12.5 packages for 18.10.3 and 18.9.5 are not present in this release.

Updating

To update GitLab, see the Update page. To update GitLab Runner, see the Updating the Runner page.

Note: GitLab releases have skipped 18.10.2, 18.9.4 and 18.8.8. There are no patches with these version numbers.

Receive Patch Notifications

To receive patch blog notifications delivered to your inbox, visit our contact us page. To receive release notifications via RSS, subscribe to our patch release RSS feed or our RSS feed for all releases.

On March 25, 2026, we released versions 18.10.1, 18.9.3, 18.8.7 for GitLab Community Edition (CE) and Enterprise Edition (EE).

These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action.

GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases: scheduled releases and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays. For more information, please visit our releases handbook and security FAQ. You can see all of GitLab release blog posts here.

For security fixes, the issues detailing each vulnerability are made public on our issue tracker 30 days after the release in which they were patched.

We are committed to ensuring that all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. To maintain good security hygiene, it is highly recommended that all customers upgrade to the latest patch release for their supported version. You can read more best practices in securing your GitLab instance in our blog post.

Recommended Action

We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible.

When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, it means all types are affected.

Security fixes

Table of security fixes

CVE-2026-2370 - Improper Handling of Parameters issue in Jira Connect installations impacts GitLab CE/EE

GitLab has remediated an issue affecting Jira Connect installations that could have allowed an authenticated user with minimal workspace permissions to obtain installation credentials and impersonate the GitLab app due to improper authorization checks.

Impacted Versions: GitLab CE/EE: all versions from 14.3 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1
CVSS 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)

Thanks maksyche for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2026-3857 - Cross-Site Request Forgery issue in GLQL API impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed an unauthenticated user to execute arbitrary GraphQL mutations on behalf of authenticated users due to insufficient CSRF protection.

Impacted Versions: GitLab CE/EE: all versions from 17.10 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1
CVSS 8.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N)

Thanks ahacker1 for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2026-2995 - HTML Injection in vulnerability report impacts GitLab EE

GitLab has remediated an issue that could have allowed an authenticated user to add email addresses to targeted user accounts due to improper sanitization of HTML content.

Impacted Versions: GitLab EE: all versions from 15.4 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1
CVSS 7.7 (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N)

Thanks a_m_a_m and yvvdwf for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2026-3988 - Denial of Service issue in GraphQL API impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed an unauthenticated user to cause a denial of service by making the GitLab instance unresponsive due to improper input validation in GraphQL request processing.

Impacted Versions: GitLab CE/EE: all versions from 18.5 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1
CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Thanks svalkanov for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2026-2745 - Improper Access Control issue in WebAuthn 2FA impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed an unauthenticated user to bypass WebAuthn two-factor authentication and gain unauthorized access to user accounts due to inconsistent input validation in the authentication process.

Impacted Versions: GitLab CE/EE: all versions from 7.11 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1
CVSS 6.8 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N)

Thanks a0xnirudh for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2026-1724 - Improper Access Control issue in GraphQL query impacts GitLab EE

GitLab has remediated an issue that could have allowed an unauthenticated user to access API tokens of self-hosted AI models due to improper access control.

Impacted Versions: GitLab EE: all versions from 18.5 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1
CVSS 6.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N)

Thanks maksyche for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2025-13436 - Denial of Service issue in CI configuration processing impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed an authenticated user to cause a denial of service due to excessive resource consumption when handling certain CI-related inputs.

Impacted Versions: GitLab CE/EE: all versions from 13.7 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1
CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Thanks a92847865 for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2025-13078 - Denial of Service issue in webhook configuration impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed an authenticated user to cause a denial of service due to excessive resource consumption when processing certain webhook configuration inputs.

Impacted Versions: GitLab CE/EE: all versions from 16.10 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1
CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Thanks lucky_luke for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2026-2973 - Cross-site Scripting issue in Mermaid diagram renderer impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed an authenticated user to execute arbitrary JavaScript in a user’s browser due to improper sanitization of entity-encoded content in Mermaid diagrams.

Impacted Versions: GitLab CE/EE: all versions from 17.7 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1
CVSS 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)

Thanks go7f0 for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2026-2726 - Improper Access Control issue in Merge Requests impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed an authenticated user to perform unauthorized actions on merge requests in other projects due to improper access control during cross-repository operations.

Impacted Versions: GitLab CE/EE: all versions from 11.10 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1
CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)

Thanks pkkr for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2025-14595 - Access Control issue in GraphQL API impacts GitLab EE

GitLab has remediated an issue that under certain conditions could have allowed an authenticated user with Planner role to view security category metadata and attributes in group security configuration due to improper access control.

Impacted Versions: GitLab EE: all versions from 18.6 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1
CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

Thanks kamikaze1337 for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2026-4363 - Incorrect Authorization issue in authorization caching impacts GitLab EE

GitLab has remediated an issue that under certain conditions could have allowed an authenticated user to gain unauthorized access to resources due to improper caching of authorization decisions.

Impacted Versions: GitLab EE: all versions from 18.1 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1
CVSS 3.7 (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N)

This vulnerability was discovered internally by GitLab team member Fred de Gier.

Bug fixes

18.10.1

• Backport gocloud version and checksum fix to 18-10 stable
• [18.10] Zero downtime reindexing make setting async-durability optional
• Backport “CI: Update CNG mirror skip job regex”
• Backport of ‘Revert Code review flow automatic reviews enabled by default for groups’
• Backport Handle http-abort panic and pass http execution error
• Backport 18.10: Do not check column default in state machine initialization
• Backport of What’s new - 18.10
• [18.10 Backport] Fix statement timeouts on p_ci_job_artifacts during pipeline deletion
• Backport of “Execute BBM affected by single record table bug”
• Fix regression: “Git operations for Deploy keys fail on a Geo Site”

18.9.3

• Backport gocloud version and checksum fix to 18-9 stable
• [Backport 18.9] Fix gitlab:setup failure on fresh database
• [18.9] Update dependency oj to v3.16.15
• Backport of ‘Use v-safe-html for commit.titleHtml in collapsible commit info’
• 18.9 Backport of ‘Fix re-archiving projects and subgroups after group unarchive’
• Backport of ‘Fix edit in pipeline editor button not showing on ci file on file navigation’
• [18.9] GLQL advanced finder, remove project_ids
• Backport of ‘Update rack gem to 2.2.22’
• Backport oj and oj-introspect gem updates
• [18.9] Exclude group-covered projects from search authorization to reduce redundant payload
• Backport “CI: Update CNG mirror skip job regex”
• [18.9] Zero downtime reindexing make setting async-durability optional
• Backport 18.9: Do not check column default in state machine initialization
• Backport of “Execute BBM affected by single record table bug”
• [18.9 Backport] Fix statement timeouts on p_ci_job_artifacts during pipeline deletion
• Fix regression: “Git operations for Deploy keys fail on a Geo Site”
• Backport: Fix Valkey version detection
• 18.9 Backport CI: Fix the package install for zypper based distros
• [18.9] Backport Mattermost Security Updates February 23, 2026
• Backport 18-9-stable - check-packages uses Pulp

18.8.7

• Fix command execution race condition in Agentic Chat
• Backport of ‘fix: allow explain for all add ons’
• [18.8] Update dependency oj to v3.16.15
• 18.8 Backport of ‘Fix re-archiving projects and subgroups after group unarchive’
• Add DAP self-hosted model DAP check in user_authorizable
• Backport of ‘Fix edit in pipeline editor button not showing on ci file on file navigation’
• [18.8] GLQL advanced finder, remove project_ids
• Backport oj and oj-introspect gem updates
• Backport of ‘Update rack gem to 2.2.22’
• Backport “CI: Update CNG mirror skip job regex”
• [18.8] Exclude group-covered projects from search authorization to reduce redundant payload
• [18.8] Zero downtime reindexing make setting async-durability optional
• Backport of “Execute BBM affected by single record table bug”
• [18.8 Backport] Fix statement timeouts on p_ci_job_artifacts during pipeline deletion
• Fix regression: “Git operations for Deploy keys fail on a Geo Site”
• 18.8 Backport CI: Fix the package install for zypper based distros
• [18.8] Backport Mattermost Security Updates February 23, 2026
• Backport 18-8-stable - check-packages uses Pulp

Important notes on upgrading

The SLES 12.5 package is not available for GitLab 18.10.1.

This patch includes database migrations that may impact your upgrade process.

Impact on your installation:

• Single-node instances: This patch will cause downtime during the upgrade as migrations must complete before GitLab can start.
• Multi-node instances: With proper zero-downtime upgrade procedures, this patch can be applied without downtime.

Post-deploy migrations

The following versions include post-deploy migrations that can run after the upgrade:

• 18.10.1
• 18.9.3
• 18.8.7

To learn more about the impact of upgrades on your installation, see:

• Zero-downtime upgrades for multi-node deployments
• Standard upgrades for single-node installations

Updating

To update GitLab, see the Update page. To update GitLab Runner, see the Updating the Runner page.

Receive Patch Notifications

To receive patch blog notifications delivered to your inbox, visit our contact us page. To receive release notifications via RSS, subscribe to our patch release RSS feed or our RSS feed for all releases.

On March 11, 2026, we released versions 18.9.2, 18.8.6, 18.7.6 for GitLab Community Edition (CE) and Enterprise Edition (EE).

These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action.

GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases: scheduled releases and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays. For more information, please visit our releases handbook and security FAQ. You can see all of GitLab release blog posts here.

For security fixes, the issues detailing each vulnerability are made public on our issue tracker 30 days after the release in which they were patched.

We are committed to ensuring that all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. To maintain good security hygiene, it is highly recommended that all customers upgrade to the latest patch release for their supported version. You can read more best practices in securing your GitLab instance in our blog post.

Recommended Action

We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible.

When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, it means all types are affected.

Security fixes

Table of security fixes

CVE-2026-1090 - Cross-site Scripting issue in Markdown placeholder processing impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed an authenticated user, when the markdown_placeholders feature flag was enabled, to inject JavaScript in a browser due to improper sanitization of placeholder content in markdown processing.

Impacted Versions: GitLab CE/EE: all versions from 10.6 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2
CVSS 8.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N)

Thanks yvvdwf for reporting this vulnerability through our HackerOne bug bounty program

CVE-2026-1069 - Denial of Service issue in GraphQL API impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed an unauthenticated user to cause a denial of service condition by sending specially crafted GraphQL requests due to uncontrolled recursion under certain circumstances.

Impacted Versions: GitLab CE/EE: all versions from 18.9 before 18.9.2
CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Thanks a92847865 for reporting this vulnerability through our HackerOne bug bounty program

CVE-2025-13929 - Denial of Service issue in repository archive endpoint impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed an unauthenticated user to cause a denial of service condition by issuing specially crafted requests to repository archive endpoints under certain conditions.

Impacted Versions: GitLab CE/EE: all versions from 10.0 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2
CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Thanks joaxcar for reporting this vulnerability through our HackerOne bug bounty program

CVE-2025-14513 - Denial of Service issue in protected branches API impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed an unauthenticated user to cause a denial of service condition due to improper input validation when processing specially crafted JSON payloads in the protected branches API.

Impacted Versions: GitLab CE/EE: all versions from 16.11 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2
CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Thanks a92847865 for reporting this vulnerability through our HackerOne bug bounty program

CVE-2025-13690 - Denial of Service issue in webhook custom headers impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed an authenticated user to cause a denial of service condition due to improper input validation on webhook custom header names under certain conditions.

Impacted Versions: GitLab CE/EE: all versions from 16.11 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2
CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Thanks sim4n6 for reporting this vulnerability through our HackerOne bug bounty program

CVE-2025-12576 - Denial of Service issue in webhook endpoint impacts GitLab CE/EE

GitLab has remediated an issue that under certain conditions could have allowed an authenticated user to cause a denial of service condition due to improper handling of webhook response data.

Impacted Versions: GitLab CE/EE: all versions from 9.3 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2
CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Thanks sim4n6 for reporting this vulnerability through our HackerOne bug bounty program

CVE-2026-3848 - Improper Neutralization of CRLF Sequences issue impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed an authenticated user to make unintended internal requests through proxy environments under certain conditions due to improper input validation in import functionality.

Impacted Versions: GitLab CE/EE: all versions from 8.11 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2
CVSS 5.0 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N)

Thanks shells3c for reporting this vulnerability.

CVE-2025-12555 - Improper Access Control issue in runners API impacts GitLab CE/EE

GitLab has remediated an issue that, under certain conditions, could have allowed an authenticated user to access previous pipeline job information on projects with repository and CI/CD disabled due to improper authorization checks.

Impacted Versions: GitLab CE/EE: all versions from 15.1 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2
CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

Thanks iamgk808 for reporting this vulnerability through our HackerOne bug bounty program

CVE-2026-0602 - Improper Access Control issue in snippet rendering impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed an authenticated user to disclose metadata from private issues, merge requests, epics, milestones, or commits due to improper filtering in the snippet rendering process under certain circumstances.

Impacted Versions: GitLab CE/EE: all versions from 15.6 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2
CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

Thanks go7f0 for reporting this vulnerability through our HackerOne bug bounty program

CVE-2026-1732 - Information Disclosure issue in inaccessible issues impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed an authenticated user to disclose confidential issue titles due to improper filtering under certain circumstances.

Impacted Versions: GitLab CE/EE: all versions from 12.6 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2
CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

Thanks modhanami for reporting this vulnerability through our HackerOne bug bounty program

CVE-2026-1663 - Missing Authorization issue in Group Import impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed an authenticated user with group import permissions to create labels in private projects due to improper authorization validation in the group import process under certain circumstances.

Impacted Versions: GitLab CE/EE: all versions from 14.4 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2
CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)

Thanks go7f0 for reporting this vulnerability through our HackerOne bug bounty program

CVE-2026-1230 - Incorrect Reference issue in repository download impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed an authenticated user to cause repository downloads to contain different code than displayed in the web interface due to incorrect validation of branch references under certain circumstances.

Impacted Versions: GitLab CE/EE: all versions from 1.0 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2
CVSS 4.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N)

Thanks st4nly0n for reporting this vulnerability through our HackerOne bug bounty program

CVE-2026-1182 - Information Disclosure issue in confidential issues impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed an authenticated user to gain unauthorized access to confidential issue titles created in public projects under certain circumstances.

Impacted Versions: GitLab CE/EE: all versions from 8.14 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2
CVSS 4.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

Thanks yvvdwf for reporting this vulnerability through our HackerOne bug bounty program

CVE-2025-12704 - Incorrect Authorization issue in Virtual Registry impacts GitLab EE

GitLab has remediated an issue that could have allowed an authenticated user to access Virtual Registry data in groups where they are not members due to improper authorization under certain conditions.

Impacted Versions: GitLab EE: all versions from 18.2 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2
CVSS 3.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N)

Thanks mateuszek for reporting this vulnerability through our HackerOne bug bounty program

CVE-2025-12697 - Improper Escaping of Output issue in Datadog integration impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed an authenticated user with maintainer-role permissions to reveal Datadog API credentials under certain conditions.

Impacted Versions: GitLab CE/EE: all versions from 15.5 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2
CVSS 2.2 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N)

Thanks shells3c for reporting this vulnerability through our HackerOne bug bounty program

Bug fixes

18.9.2

• Fix GitLab base caching (Backport 18.9)
• config: Add configuration to control GOMAXPROCS [backport to 18.9]
• Backport of ‘Fix test pollution from simulate_saas rake task’
• Backport of ‘Add backtrace to placeholder user reassignment failure logs’
• [Backport 18.9] Update bitbucket cloud importer to fetch workspace scoped repositories
• Backport of “Remove old DAP troubleshooting docs”
• Backport BBM - Fix helper with single record
• [18.9] Backport of ‘Reduce logs by ConcurrencyLimit::WorkerExecutionTracker’
• Backport of Reduce batch size for text-embedding-005 requests
• [Backport]- Fix transpilers for zoekt filters
• Backport of ‘Fix exclude types in session query’
• [Backport]- Skip param validation for MCP requests
• Backport of 591296 Historical Addon Assignments - Ignore Namespace Path For SM
• Backport of ‘Handle Jira Server/Data Center Issue pagination’ (18.9)
• Backport ‘Improve Deployments and Size quota specs for clarity and consistency’ to 18-9-stable-ee
• Backport- Code search returns no results at intermediate group level
• Backport of ‘Move ConcurrencyLimit::ResumeWorker cron config to CE’
• Backport of ‘Extend package migrate task to metadata caches and symbols’
• Backport of ‘Stop unblocking policy approvals when security jobs get canceled’
• Backport of Revert “Clean up gpg_commit_delegate_to_signature feature flag”
• Support default AI access rules - Backport of 225728
• Backport of ‘Fix maintainers editing when they own a fork’
• [18-9-stable] Remove release instance deployment trigger from Ubuntu-20.04-staging job
• [18.9] Backport Mattermost Security Updates February 18, 2026
• Backport: Simplify pg-upgrade initdb by removing locale parameters
• [18.9] Patch io-event gem to drop epoll_pwait2 check for RedHat 9

18.8.6

• Backport Go 1.25.7 to 18.8 Stable
• Fix GitLab base caching (Backport 18.8)
• Backport of “fix(bug): Schema check should not fail when ClickHouse DB is uninitialized”
• config: Add configuration to control GOMAXPROCS [backport to 18.8]
• 18.8 Backport of ‘Fix PipelineSecurityReportFindings query timeout’
• Backport 18.8 - CI - Token used for release environments
• Handle RecordInvalid in SyncProjectPolicyWorker
• [Backport 18.8] Update bitbucket cloud importer to fetch workspace scoped repositories
• [18.8] Backport of ‘Reduce logs by ConcurrencyLimit::WorkerExecutionTracker’
• Backport BBM - Fix helper with single record
• Backport of ‘Fix Duo sidebar absent for user with Agentic Chat access but without Classic Chat access’
• [Backport]- Fix transpilers for zoekt filters
• Backport of 591296 Historical Addon Assignments - Ignore Namespace Path For SM
• Backport of ‘Handle Jira Server/Data Center Issue pagination’
• Backport ‘Improve Deployments and Size quota specs for clarity and consistency’ to 18-8-stable-ee
• Backport- Code search returns no results at intermediate group level
• Backport of ‘Move ConcurrencyLimit::ResumeWorker cron config to CE’
• Support default AI access rules - Backport of 225728
• Backport Go 1.25.7 to GitLab 18.8
• [18-8-stable] Remove release instance deployment trigger from Ubuntu-20.04-staging job
• [18.8] Mattermost Security Updates February 18, 2026
• [18.8] Patch io-event gem to drop epoll_pwait2 check for RedHat 9

18.7.6

• Backport Go 1.25.7 to 18.7 Stable
• Fix GitLab base caching (Backport 18.7)
• Backport 18.7 - CI - Token used for release environments
• Handle RecordInvalid in SyncProjectPolicyWorker
• [Backport 18.7] Update bitbucket cloud importer to fetch workspace scoped repositories
• [18.7] Backport of ‘Reduce logs by ConcurrencyLimit::WorkerExecutionTracker’
• [Backport]- Fix transpilers for zoekt filters
• Backport- Code search returns no results at intermediate group level
• Backport of 591296 Historical Addon Assignments - Ignore Namespace Path For SM
• Backport of ‘Handle Jira Server/Data Center Issue pagination’
• Backport ‘Improve Deployments and Size quota specs for clarity and consistency’ to 18-7-stable-ee
• Backport of ‘Move ConcurrencyLimit::ResumeWorker cron config to CE’
• [18.7] Fix image resizing assertion logic for RTE
• Backport Go 1.25.7 to GitLab 18.7
• [18-7-stable] Remove release instance deployment trigger from Ubuntu-20.04-staging job
• [18.7] Backport Mattermost Security Updates February 18, 2026
• [18.7] Patch io-event gem to drop epoll_pwait2 check for RedHat 9

Important notes on upgrading

This patch includes database migrations that may impact your upgrade process.

Impact on your installation:

• Single-node instances: This patch will cause downtime during the upgrade as migrations must complete before GitLab can start.
• Multi-node instances: With proper zero-downtime upgrade procedures, this patch can be applied without downtime.

Regular migrations

The following versions include regular migrations that run during the upgrade process:

• 18.9.2
• 18.8.6

To learn more about the impact of upgrades on your installation, see:

• Zero-downtime upgrades for multi-node deployments
• Standard upgrades for single-node installations

Updating

To update GitLab, see the Update page. To update GitLab Runner, see the Updating the Runner page.

Receive Patch Notifications

To receive patch blog notifications delivered to your inbox, visit our contact us page. To receive release notifications via RSS, subscribe to our patch release RSS feed or our RSS feed for all releases.

On February 25, 2026, we released versions 18.9.1, 18.8.5, 18.7.5 for GitLab Community Edition (CE) and Enterprise Edition (EE).

These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action.

GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases: scheduled releases and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays. For more information, please visit our releases handbook and security FAQ. You can see all of GitLab release blog posts here.

For security fixes, the issues detailing each vulnerability are made public on our issue tracker 30 days after the release in which they were patched.

We are committed to ensuring that all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. To maintain good security hygiene, it is highly recommended that all customers upgrade to the latest patch release for their supported version. You can read more best practices in securing your GitLab instance in our blog post.

Recommended Action

We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible.

When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, it means all types are affected.

Security fixes

Table of security fixes

CVE-2026-0752 - Cross-site Scripting issue in Mermaid sandbox impacts GitLab CE/EE

GitLab has remediated an issue that under certain circumstances, could have allowed an unauthenticated user to inject arbitrary scripts into the Mermaid sandbox UI.

Impacted Versions: GitLab CE/EE: all versions from 16.2 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1
CVSS 8.0 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N)

Thanks aphantom for reporting this vulnerability through our HackerOne bug bounty program

CVE-2025-14511 - Denial of Service issue in container registry impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed an unauthenticated user to cause denial of service by sending specially crafted files to the container registry event endpoint under certain conditions.

Impacted Versions: GitLab CE/EE: all versions from 12.2 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1
CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Thanks a92847865 for reporting this vulnerability through our HackerOne bug bounty program

CVE-2026-1662 - Denial of Service issue in Jira events endpoint impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed an unauthenticated user to cause Denial of Service by sending specially crafted requests to the Jira events endpoint.

Impacted Versions: GitLab CE/EE: all versions from 14.4 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1
CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Thanks a92847865 for reporting this vulnerability through our HackerOne bug bounty program

CVE-2026-1388 - Regular Expression Denial of Service issue in GitLab merge requests impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed an unauthenticated user to cause regular expression denial of service by sending specially crafted input to a merge request endpoint under certain conditions.

Impacted Versions: GitLab CE/EE: all versions from 9.2 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1
CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Thanks sim4n6 for reporting this vulnerability through our HackerOne bug bounty program

CVE-2026-2845 - Missing rate limit in Bitbucket Server importer impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed an authenticated user to cause denial of service by exploiting a Bitbucket Server import endpoint via repeatedly sending large responses.

Impacted Versions: GitLab CE/EE: all versions from 11.2 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1
CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

This vulnerability has been discovered internally by GitLab team member Sam Word

CVE-2025-3525 - Denial of Service issue in CI trigger API impacts GitLab CE/EE

GitLab has remediated an issue that could have, under certain circumstances, allowed an authenticated user with certain access to cause denial of service by creating specially crafted CI triggers via the API.

Impacted Versions: GitLab CE/EE: all versions from 9.0 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1
CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Thanks pwnie for reporting this vulnerability through our HackerOne bug bounty program

CVE-2026-1725 - Denial of Service issue in token decoder impacts GitLab CE/EE

GitLab has remediated an issue that could have under certain conditions, allowed an unauthenticated user to cause denial of service by sending specially crafted requests to a CI jobs API endpoint.

Impacted Versions: GitLab CE/EE: versions from 18.9 before 18.9.1
CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

Thanks vinax for reporting this vulnerability through our HackerOne bug bounty program

CVE-2026-1747 - Improper Access Control issue in Conan package registry impacts GitLab EE

GitLab has remediated an issue that, under certain conditions, could have allowed Developer-role users with insufficient privileges to make unauthorized modifications to protected Conan packages.

Impacted Versions: GitLab EE: all versions from 17.11 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1
CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)

Thanks modhanami for reporting this vulnerability through our HackerOne bug bounty program

CVE-2025-14103 - Access Control issue in CI job mutation impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed an unauthorized user with Developer-role permissions to set pipeline variables for manually triggered jobs under certain conditions.

Impacted Versions: GitLab CE/EE: all versions from 17.7 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1
CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)

Thanks go7f0 for reporting this vulnerability through our HackerOne bug bounty program

Bug fixes

18.9.1

• Backport of fix semantic code search for Premium plans
• Backport of “Implement usage of namespace AI data collection setting”
• Backport of AI data collection docs
• Backport of “Add exclude_types to the get_agent_flows query”
• Backport of “Bypass group membership lock for service accounts”
• Backport 18.9 - CI - Token used for release environments
• [Backport] Zoekt Fix the bug of includeForked
• Backport of Fix adding flows when member invites are disabled
• Backport of Fix workspace PAT creation with short PAT lifetime
• Backport of Remove API dependency on composite identity onboarding

18.8.5

• Disable gitlab credits dashboard page for SM trial
• Backport: Workhorse: Ignore misconfigured redis for DWS locking
• Backport of skip rebase check for detailed merge status
• Backport of ‘Time to first byte degradation on list merge requests API’
• Backport of Update gitlab-cloud-connector gem to 1.44
• Backport - Remove orphaned zoektCrossNamespaceSearch feature flag reference
• Move bot avatar assets to app/assets for proper asset pipeline inclusion
• Backport of ‘Geo Primary Verification: Check actual verification state when checksumming’
• Backport of Fix introspection query
• Backport PG::UntranslatableCharacter fixes for MoveCiBuildsMetadata background migration
• Backport optimizing of the MergeRequestResetApprovals Worker
• Backport of ‘Remove unused retag-gdk-image CI job’
• Backport of “Docs: Added support for Credits and DAP from 18.8 and later”
• Backport of ‘Enable the disable_all_mentions FF by default ‘
• Backport of Validate milestone title for group import
• Backport of workhorse: Return 400 from /cable without valid websocket upgrade
• Skip Feature.enabled? override in test environment - 18.8
• [Backport] Zoekt Fix the bug of includeForked
• Backport of “Bypass group membership lock for service accounts”
• Backport of Fix adding flows when member invites are disabled
• Backport of Reset group_push_rules primary key sequence
• Backport of Fix workspace PAT creation with short PAT lifetime
• Backport Use new auth in advanced wiki search

18.7.5

• Backport of ‘Fix Zoekt indexing by cleaning up replicas without indices’
• Backport of ‘Time to first byte degradation on list merge requests API’
• Backport of Validate milestone title for group import
• Backport of ‘Remove unused retag-gdk-image CI job’
• Backport of workhorse: Return 400 from /cable without valid websocket upgrade
• Backport of Reset group_push_rules primary key sequence
• Backport Use new auth in advanced wiki search

Important notes on upgrading

The SLES 12.5 package is not available for GitLab 18.9.1.

This patch includes database migrations that may impact your upgrade process.

Impact on your installation:

• Single-node instances: This patch will cause downtime during the upgrade as migrations must complete before GitLab can start.
• Multi-node instances: With proper zero-downtime upgrade procedures, this patch can be applied without downtime.

Post-deploy migrations

The following versions include post-deploy migrations that can run after the upgrade:

• 18.8.5

To learn more about the impact of upgrades on your installation, see:

• Zero-downtime upgrades for multi-node deployments
• Standard upgrades for single-node installations

Updating

To update GitLab, see the Update page. To update GitLab Runner, see the Updating the Runner page.

Receive Patch Notifications

To receive patch blog notifications delivered to your inbox, visit our contact us page. To receive release notifications via RSS, subscribe to our patch release RSS feed or our RSS feed for all releases.

On February 10, 2026, we released versions 18.8.4, 18.7.4, 18.6.6 for GitLab Community Edition (CE) and Enterprise Edition (EE).

These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action.

GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases: scheduled releases and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays. For more information, please visit our releases handbook and security FAQ. You can see all of GitLab release blog posts here.

For security fixes, the issues detailing each vulnerability are made public on our issue tracker 30 days after the release in which they were patched.

We are committed to ensuring that all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. To maintain good security hygiene, it is highly recommended that all customers upgrade to the latest patch release for their supported version. You can read more best practices in securing your GitLab instance in our blog post.

Recommended Action

We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible.

When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, it means all types are affected.

Security fixes

Table of security fixes

CVE-2025-7659 - Incomplete Validation issue in Web IDE impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed an unauthenticated user to steal tokens and access private repositories by abusing incomplete validation in the Web IDE.

Impacted Versions: GitLab CE/EE: all versions from 18.2 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4
CVSS 8.0 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N)

Thanks cav0ur for reporting this vulnerability through our HackerOne bug bounty program

CVE-2025-8099 - Denial of Service issue in GraphQL introspection impacts GitLab CE/EE

GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to cause denial of service by sending repeated GraphQL queries.

Impacted Versions: GitLab CE/EE: all versions from 10.8 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4
CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Thanks foxribeye for reporting this vulnerability through our HackerOne bug bounty program

CVE-2026-0958 - Denial of Service issue in JSON validation middleware impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed an unauthenticated user to cause denial of service through memory or CPU exhaustion by bypassing JSON validation middleware limits.

Impacted Versions: GitLab CE/EE: all versions from 18.4 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4
CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Thanks elbo7 for reporting this vulnerability through our HackerOne bug bounty program

CVE-2025-14560 - Cross-site Scripting issue in Code Flow impacts GitLab CE/EE

GitLab has remediated an issue that, under certain conditions could have allowed an authenticated user to perform unauthorized actions on behalf of another user by injecting content into vulnerability code flow.

Impacted Versions: GitLab CE/EE: all versions from 17.1 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4
CVSS 7.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N)

Thanks joaxcar and yvvdwf for reporting this vulnerability through our HackerOne bug bounty program

CVE-2026-0595 - HTML Injection issue in test case titles impacts GitLab CE/EE

GitLab has remediated an issue that, under certain conditions, could have allowed an authenticated user to add unauthorized email addresses to user accounts through HTML injection in test case titles.

Impacted Versions: GitLab CE/EE: all versions from 13.9 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4
CVSS 7.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N)

Thanks joaxcar for reporting this vulnerability through our HackerOne bug bounty program

CVE-2026-1458 - Denial of Service issue in Markdown processor impacts GitLab CE/EE

GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to cause denial of service by uploading specifically crafted files.

Impacted Versions: GitLab CE/EE: all versions from 8.0 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4
CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Thanks maksyche for reporting this vulnerability through our HackerOne bug bounty program

CVE-2026-1456 - Denial of Service issue in Markdown Preview impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed an unauthenticated user to cause denial of service through CPU exhaustion by submitting specially crafted markdown files that trigger exponential processing in markdown preview.

Impacted Versions: GitLab CE/EE: all versions from 18.7 before 18.7.4, and 18.8 before 18.8.4
CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Thanks maksyche for reporting this vulnerability through our HackerOne bug bounty program

CVE-2026-1387 - Denial of Service issue in dashboard impacts GitLab EE

GitLab has remediated an issue that could have allowed an authenticated user to cause denial of service by uploading a specially crafted file to the dashboard and repeatedly sending GraphQL queries to parse it.

Impacted Versions: GitLab EE: all versions from 15.6 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4
CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Thanks a92847865 for reporting this vulnerability through our HackerOne bug bounty program

CVE-2025-12575 - Server-Side Request Forgery issue in Virtual Registry impacts GitLab EE

GitLab has remediated an issue that, under certain conditions, could have allowed an authenticated user with certain permissions to perform server-side request forgery against internal network services.

Impacted Versions: GitLab EE: all versions from 18.0 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4
CVSS 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)

Thanks go7f0qho for reporting this vulnerability through our HackerOne bug bounty program

CVE-2026-1094 - Improper Validation issue in diff parser impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed an authenticated developer to hide specially crafted file changes from the WebUI.

Impacted Versions: GitLab CE/EE: all versions from 18.8 before 18.8.4
CVSS 4.6 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N)

Thanks u3mur4 for reporting this vulnerability through our HackerOne bug bounty program

CVE-2025-12073 - Server-Side Request Forgery issue in Git repository import impacts GitLab CE/EE

GitLab has remediated an issue that, under certain conditions, could have allowed an authenticated user to perform server-side request forgery against internal services by bypassing protections in the Git repository import functionality.

Impacted Versions: GitLab CE/EE: all versions from 18.0 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4
CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)

Thanks yunus0x for reporting this vulnerability through our HackerOne bug bounty program

CVE-2026-1080 - Authorization Bypass issue in iterations API impacts GitLab EE

GitLab has remediated an issue that, under certain conditions, could have allowed an authenticated user to access iteration data from private descendant groups by querying the iterations API endpoint.

Impacted Versions: GitLab EE: all versions from 16.7 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4
CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

Thanks go7f0 for reporting this vulnerability through our HackerOne bug bounty program

CVE-2025-14592 - Missing Authorization issue in GLQL API impacts GitLab CE/EE

GitLab has remediated an issue that, under certain conditions, could have allowed an authenticated user to perform unauthorized operations by submitting GraphQL mutations through the GLQL API endpoint.

Impacted Versions: GitLab CE/EE: all versions from 18.6 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4
CVSS 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)

Thanks go7f0 for reporting this vulnerability through our HackerOne bug bounty program

CVE-2026-1282 - Stored HTML Injection issue in project label impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed an authenticated user to inject content into project labels titles.

Impacted Versions: GitLab CE/EE: all versions from 18.6 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4
CVSS 3.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N)

Thanks rafabd1 for reporting this vulnerability through our HackerOne bug bounty program

CVE-2025-14594 - Authorization Bypass issue in Pipeline Schedules API impacts GitLab CE/EE

GitLab has remediated an issue that, under certain conditions, could have allowed an authenticated user to view certain pipeline values by querying the API.

Impacted Versions: GitLab CE/EE: all versions from 17.11 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4
CVSS 3.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N)

Thanks sndd for reporting this vulnerability through our HackerOne bug bounty program

Bug fixes

18.8.4

• Backport dependency update golang/go to v1.24.12
• Backport of Fix project state getting out of sync when deletion fails
• Backport of ‘Add migrations for missing merge_requests stage 2 indexes for bigint’
• Backport-Group/Global search should not show code tab if no zoekt nodes are available & advanced search is off
• [Backport 18.8] Exclude Git LFS paths from Git HTTP throttling
• Backport of Add REST endpoint for seeding external agents
• Backport of Update seeded third party flows descriptions
• Backport of Add seed external agents button to Admin > GitLab Duo
• Backport of ‘Fix Duo Enterprise add-on check to use seat assignment instead of namespace membership’
• Backport of ‘Add paidTierTrial to subscriptionUsage GraphQL API’
• [Backport] Add preflight checks to resume_indexing rake task
• Backport: DAP onboarding UX
• Backport of ‘Add usage billing paid tier trial card’
• Backports ‘Fixes duo chat visible if user does not have permission’
• Backport of ‘Fix Zoekt indexing by cleaning up replicas without indices’
• Flip dap_onboarding_empty_states back off
• Disable credits page for SM in trial
• Backport of ‘Update dependency gitlab-cloud-connector to 1.43.0’
• Backport Go 1.24.12 to 18-8-Stable
• [18.8] Backport Mattermost Security Updates January 15, 2026

18.7.4

• Backport of ‘Fix: DAP enablement setting availability’
• 18.7 Backport of ‘Fix PipelineSecurityReportFindings query timeout’
• [Backport] Add preflight checks to resume_indexing rake task
• [18.7] Backport Mattermost Security Updates January 15, 2026

18.6.6

• 18.6 Backport of ‘Fix PipelineSecurityReportFindings query timeout’
• [Backport] Add preflight checks to resume_indexing rake task
• [18.6] Backport Mattermost Security Updates January 15, 2026

GitLab Ultimate trials updated to include GitLab Duo Agent Platform

GitLab.com Ultimate trials now include evaluation credits for GitLab Duo Agent Platform. On GitLab.com, signing up for an Ultimate trial provides 24 evaluation credits per user for 30 days to exercise agentic AI capabilities such as autonomous task execution and multi‑step workflow orchestration. Self-managed customers should update to GitLab 18.9 upon release to get the best trial experience. GitLab.com free tier namespaces can start an Ultimate trial today.

Start your free trial. Current paid customers can request evaluation credits through their account team and begin technical setup ahead of the 18.9 release contact Sales to learn more.

Important notes on upgrading

This patch includes database migrations that may impact your upgrade process.

Impact on your installation:

• Single-node instances: This patch will cause downtime during the upgrade as migrations must complete before GitLab can start.
• Multi-node instances: With proper zero-downtime upgrade procedures, this patch can be applied without downtime.

Post-deploy migrations

The following versions include post-deploy migrations that can run after the upgrade:

• 18.8.4

To learn more about the impact of upgrades on your installation, see:

• Zero-downtime upgrades for multi-node deployments
• Standard upgrades for single-node installations

Updating

To update GitLab, see the Update page. To update GitLab Runner, see the Updating the Runner page.

Receive Patch Notifications

To receive patch blog notifications delivered to your inbox, visit our contact us page. To receive release notifications via RSS, subscribe to our patch release RSS feed or our RSS feed for all releases.

On February 6, 2026, we released versions 18.6.2, 18.7.1, and 18.8.1 of the GitLab AI Gateway.

These versions contain a critical security fix for GitLab Duo Self-Hosted AI Gateway, and we strongly recommend that all Self Managed customers with GitLab Duo Self-Hosted installations update to one of these versions immediately.

A fix has already been deployed for the GitLab-hosted AI Gateway. Customers using GitLab.com, GitLab Dedicated, and GitLab Self Managed instances with GitLab-hosted AI Gateway are protected and do not need to take action.

Recommended Action

We strongly recommend that all GitLab Duo Self-Hosted installations running a version of self-hosted AI Gateway affected by the issue described below are upgraded to the latest version as soon as possible.

Security fixes

Table of security fixes

CVE-2026-1868 - Insecure Template expansion issue impacts GitLab AI Gateway

The Duo Workflow Service component of GitLab AI Gateway before versions 18.6.2, 18.7.1, and 18.8.1 is vulnerable to insecure template expansion of user supplied data via crafted Duo Agent Platform Flow definitions. Authenticated access to the GitLab instance is required. This vulnerability could be used to cause Denial of Service or gain code execution on the Gateway.

Impacted Versions: GitLab AI Gateway: all versions from 18.1.6, 18.2.6, and 18.3.1 before 18.6.2, 18.7.1, and 18.8.1
CVSS 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)

This vulnerability was discovered internally by GitLab team member Joern Schneeweisz.

Updating

To update GitLab Duo Self-Hosted, see the GitLab Duo Self-Hosted install documentation.

Receive Patch Notifications

To receive patch blog notifications delivered to your inbox, visit our contact us page. To receive release notifications via RSS, subscribe to our patch release RSS feed or our RSS feed for all releases.

On February 4, 2026, we released versions 18.8.3, 18.7.3, and 18.6.5 for GitLab Community Edition and Enterprise Edition.

This patch release delivers a set of targeted fixes focused on reliability, entitlement handling, and feature-flag consistency across GitLab Duo Agent Platform deployments.

The updates reflect real-world usage across diverse environments and usage models, and are part of the normal hardening cycle for a platform that integrates deeply with GitLab workflows, identity, and usage controls. Core agent capabilities and behaviors are unchanged. This patch release does not include any security fixes.

GitLab Community Edition and Enterprise Edition

18.8.3

• Backport of ‘Pass user id to workflow service’
• Backport of ‘Unlock Duo Workflow foundational flows from experimental features’
• Backport of ‘Unlock Duo Workflow foundational flows from experimental features’

• Backport of ‘Fix enforced_scans sync with inject_policy’
• Backport of “Open service desk issues and tickets on boards in legacy view instead of drawer”
• Backport of “Add info on UI for new Ticket work item type”
• [Backport]Fix missing Open the file to view all results’ link in Zoekt
• Refactor Redis TLS options parsing to fix ActionCable configuration
• Backport of ‘Fix route constraint for Credits dashboards’
• Backport of ‘Fix Zoekt filter order to avoid performance regression’ to 18.8
• Backport: Allow to better debug initialize connection
• Backport of ‘Integrate work items into chat notifications as issue events’
• Backport of “Fixes preserving external author on work item move and clone”
• [Backport] Remove search api preload for commits scope
• Backport of “Regenerate openapi docs”

18.7.3

• Backport of ‘Add FF to toggle namespace filtering for Duo Chat data’
• Backport of ‘Remove duo_workflow_in_ci Feature Flag’
• Backport of ‘Remove duo_workflow Feature Flag’
• Backport of ‘Pass user id to workflow service’

• Backport of ‘Fix enforced_scans sync with inject_policy’
• Backport of ‘Fix Zoekt filter order to avoid performance regression’
• [Backport] Remove search api preload for commits scope
• [18.7] Only check optional ActionCable Redis instance if necessary

18.6.5

• Backport of ‘Pass user id to workflow service’

• Fix MergeRequestDiff.verifiables scope

Important notes on upgrading

This version does not include any new migrations, and for multi-node deployments, should not require any downtime.

Please be aware that by default the Omnibus packages will stop, run migrations, and start again, no matter how “big” or “small” the upgrade is. This behavior can be changed by adding a /etc/gitlab/skip-auto-reconfigure file, which is only used for updates.

Updating

To update, check out our update page.

GitLab subscriptions

Access to GitLab Premium and Ultimate features is granted by a paid subscription.

Alternatively, sign up for GitLab.com to use GitLab’s own infrastructure.

On January 21, 2026, we released versions 18.8.2, 18.7.2, 18.6.4 for GitLab Community Edition (CE) and Enterprise Edition (EE).

These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action.

GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases: scheduled releases and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays. For more information, please visit our releases handbook and security FAQ. You can see all of GitLab release blog posts here.

For security fixes, the issues detailing each vulnerability are made public on our issue tracker 30 days after the release in which they were patched.

We are committed to ensuring that all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. To maintain good security hygiene, it is highly recommended that all customers upgrade to the latest patch release for their supported version. You can read more best practices in securing your GitLab instance in our blog post.

Recommended Action

We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible.

When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, it means all types are affected.

Security fixes

Table of security fixes

CVE-2025-13927 - Denial of Service issue in Jira Connect integration impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed an unauthenticated user to create a denial of service condition by sending crafted requests with malformed authentication data.

Impacted Versions: GitLab CE/EE: all versions from 11.9 before 18.6.4, 18.7 before 18.7.2, and 18.8 before 18.8.2
CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Thanks a92847865 for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2025-13928 - Incorrect Authorization issue in Releases API impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed an unauthenticated user to cause a denial of service condition by exploiting incorrect authorization validation in API endpoints.

Impacted Versions: GitLab CE/EE: all versions from 17.7 before 18.6.4, 18.7 before 18.7.2, and 18.8 before 18.8.2
CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Thanks a92847865 for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2026-0723 - Unchecked Return Value issue in authentication services impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed an individual with existing knowledge of a victim’s credential ID to bypass two-factor authentication by submitting forged device responses.

Impacted Versions: GitLab CE/EE: all versions from 18.6 before 18.6.4, 18.7 before 18.7.2, and 18.8 before 18.8.2
CVSS 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)

Thanks ahacker1 for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2025-13335 - Infinite Loop issue in Wiki redirects impacts GitLab CE/EE

GitLab has remediated an issue that under certain circumstances could have allowed an authenticated user to create a denial of service condition by configuring malformed Wiki documents that bypass cycle detection.

Impacted Versions: GitLab CE/EE: all versions from 17.1 before 18.6.4, 18.7 before 18.7.2, and 18.8 before 18.8.2
CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Thanks sim4n6 for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2026-1102 - Denial of Service issue in API endpoint impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed an unauthenticated user to create a denial of service condition by sending repeated malformed SSH authentication requests.

Impacted Versions: GitLab CE/EE: all versions from 12.3 before 18.6.4, 18.7 before 18.7.2, and 18.8 before 18.8.2
CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

This vulnerability has been discovered internally by GitLab team member Thiago Figueiró.

Bug fixes

18.8.2

• Backport of Make external agent configurations GA
• Backport Remove GitLab Dedicated support for semantic search until it’s available
• Backport of ‘18.8.0: Merge Request reviewer dropdown crashes and does not send request’
• Backport of ‘Pass user id to workflow service’
• Backport of rake task to seed AI Catalogs with external agents
• Backport of Separate policy logic for AI Catalog Flows and Foundational Flows

18.7.2

• Backport of Fix logic for fetching occurrences related to vulnerabilties
• Backport of “Removes feature flag enablement for svc accounts”
• Backport of flaky import spec quarantine
• Backport 18.7 - Fix searchable dropdown race condition when typing fast
• Backport of Recreate p_sent_notifications.reply_key index
• Fix container_repositories index repair to handle 1-to-1 relationship
• [18.7] Fix migration health check endpoint
• Backport of ‘Fix soft wrap not working due to accessibilitySupport conflict’
• Backport of ‘Fix git push error for remote flows in self-managed instances’
• [Backport 18.7] Exclude Git LFS paths from Git HTTP throttling
• Backport of Correct Code Review Flow history for beta
• Backport of ‘Fix Duo Chat button visibility for Amazon Q’
• Backport Allow user namespaces to be indexed in Zoekt for self-managed
• Backport of ‘Disable Sidekiq retries for ClickHouse pipeline/build sync workers’
• Backport of ‘Disable async_insert in build and pipeline sync operations’
• 18.7 - Remove manual from SLES-12.5-release-pulp job

18.6.4

• Backport of “Removes feature flag enablement for svc accounts”
• Backport of flaky import spec quarantine
• Backport 18.6 - Fix searchable dropdown race condition when typing fast
• Fix container_repositories index repair to handle 1-to-1 relationship
• Backport of ‘Fix soft wrap not working due to accessibilitySupport conflict’
• Backport of ‘Fix git push error for remote flows in self-managed instances’
• [Backport 18.6] Exclude Git LFS paths from Git HTTP throttling
• Backport-Allow user namespaces to be indexed in Zoekt for self-managed
• Backport of ‘Disable Sidekiq retries for ClickHouse pipeline/build sync workers’
• Backport of ‘Disable async_insert in build and pipeline sync operations’
• 18.6 - Remove manual from SLES-12.5-release-pulp job
• Start Pulp FIPS jobs after PC FIPS jobs - 18.6
• [CI] Fix the builder image tags for the check-packages jobs 18-6

Important notes on upgrading

This patch includes database migrations that may impact your upgrade process.

Impact on your installation:

• Single-node instances: This patch will cause downtime during the upgrade as migrations must complete before GitLab can start.
• Multi-node instances: With proper zero-downtime upgrade procedures, this patch can be applied without downtime.

Post-deploy migrations

The following versions include post-deploy migrations that can run after the upgrade:

• 18.7.2

To learn more about the impact of upgrades on your installation, see:

• Zero-downtime upgrades for multi-node deployments
• Standard upgrades for single-node installations

Updating

To update GitLab, see the Update page. To update GitLab Runner, see the Updating the Runner page.

Receive Patch Notifications

To receive patch blog notifications delivered to your inbox, visit our contact us page. To receive release notifications via RSS, subscribe to our patch release RSS feed or our RSS feed for all releases.

On January 19, 2026, we released versions 18.8.1 for GitLab Community Edition and Enterprise Edition.

These versions resolve a number of regressions and bugs. This patch release does not include any security fixes.

GitLab Community Edition and Enterprise Edition

18.8.1

• Backport: Release AI Catalog External Agents
• Backport of ‘Fix summarize review prompt version for DAP Duo Code Review’
• Backport of Disallow creation of new external agents
• Backport of Correct Code Review Flow history for beta
• Backport of ‘Fix incorrectly shown limited experience alert on pipeline security tab’
• Backport of ‘Fix Duo Chat button visibility for Amazon Q’

Important notes on upgrading

This version does not include any new migrations, and for multi-node deployments, should not require any downtime.

Please be aware that by default the Omnibus packages will stop, run migrations, and start again, no matter how “big” or “small” the upgrade is. This behavior can be changed by adding a /etc/gitlab/skip-auto-reconfigure file, which is only used for updates.

Updating

To update, check out our update page.

GitLab subscriptions

Access to GitLab Premium and Ultimate features is granted by a paid subscription.

Alternatively, sign up for GitLab.com to use GitLab’s own infrastructure.

On January 7, 2026, we released versions 18.7.1, 18.6.3, 18.5.5 for GitLab Community Edition (CE) and Enterprise Edition (EE).

These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action.

GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases: scheduled releases and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays. For more information, please visit our releases handbook and security FAQ. You can see all of GitLab release blog posts here.

For security fixes, the issues detailing each vulnerability are made public on our issue tracker 30 days after the release in which they were patched.

We are committed to ensuring that all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. To maintain good security hygiene, it is highly recommended that all customers upgrade to the latest patch release for their supported version. You can read more best practices in securing your GitLab instance in our blog post.

Recommended Action

We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible.

When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, it means all types are affected.

Security fixes

Table of security fixes

CVE-2025-9222 - Stored Cross-site Scripting issue in GitLab Flavored Markdown placeholders impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed an authenticated user to achieve stored cross-site scripting by exploiting GitLab Flavored Markdown placeholder processing.

Impacted Versions: GitLab CE/EE: all versions from 18.2.2 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1
CVSS 8.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N)

Thanks yvvdwf for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2025-13761 - Cross-site Scripting issue in Web IDE impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed an unauthenticated user to execute arbitrary code in the context of an authenticated user’s browser by convincing the legitimate user to visit a specially crafted webpage.

Impacted Versions: GitLab CE/EE: all versions from 18.6 before 18.6.3, and 18.7 before 18.7.1
CVSS 8.0 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N)

Thanks joaxcar for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2025-13772 - Missing Authorization issue in Duo Workflows API impacts GitLab EE

GitLab has remediated an issue that could have allowed an authenticated user to access and utilize AI model settings from unauthorized namespaces by manipulating namespace identifiers in API requests.

Impacted Versions: GitLab EE: all versions from 18.4 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1
CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N)

This vulnerability has been discovered internally by GitLab team member Jessie Young.

CVE-2025-13781 - Missing Authorization issue in AI GraphQL mutation impacts GitLab EE

GitLab has remediated an issue that could have allowed an authenticated user to modify instance-wide AI feature provider settings by exploiting missing authorization checks in GraphQL mutations.

Impacted Versions: GitLab EE: all versions from 18.5 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1
CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)

Thanks pwnie for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2025-10569 - Denial of Service issue in import functionality impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed authenticated users to create a denial of service condition by providing crafted responses to external API calls.

Impacted Versions: GitLab CE/EE: all versions from 8.3 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1
CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Thanks a92847865 for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2025-11246 - Insufficient Access Control Granularity issue in GraphQL runnerUpdate mutation impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed authenticated users with specific permissions to remove all project runners from unrelated projects by manipulating GraphQL runner associations.

Impacted Versions: GitLab CE/EE: all versions from 15.4 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1
CVSS 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L)

Thanks pwnie for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2025-3950 - Information Disclosure issue in Mermaid diagram rendering impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed a user to leak sensitive connection information by referencing specially crafted images that bypass asset proxy protection.

Impacted Versions: GitLab CE/EE: all versions from 10.3 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1
CVSS 3.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N)

Thanks rogerace for reporting this vulnerability through our HackerOne bug bounty program.

Update Libpng version to 1.6.51

Libpng has been updated to version 1.6.51, which contains fixes for security vulnerabilities including CVE-2025-65018 and CVE-2025-64720.

Bug fixes

18.7.1

• Backport of ‘Revert Merge branch ‘582543-opinionated-duo-chat-focus’ into ‘master’’
• Backport of Add CI builds metadata migration configuration to 18.7 upgrade notes
• Backport of “Don’t try to return connections to the pool early in a web request”
• Backport of “Clear the query cache when releasing load balancing hosts”
• Backport “Fix version-skipping upgrade blocker for namespace traversal IDs backfill”
• Backport of ‘Fix Elasticsearch pagination with null sortable field values’
• [Backport 18.7] No-op BackfillSlackIntegrationsScopesShardingKey BBM
• Backport of ‘Wrap merge_data & merge_request into single transaction’
• Backport of ‘Resolve GraphQL type mismatch in Cleanup policy type’
• Backport of ‘Fix 404 errors for Duo Workflow WS connection’

18.6.3

• Log truncation to 18-6 stable branch
• Backport of ‘Add status filter argument to work items CSV export’
• Backport ’tskorupa/fix-check_e82ff70482-constraint-validation’ into ‘18-6-stable-ee’
• Backport of Add pipeline_per_user rate limit
• Backport of Dependency export fix
• 18.6 Backport: “Add type handling for findings with locations saved as Strings”
• Backport: Improve handling of attachment urls and filenames, fix undercoverage 18-6
• Backport of Fix content and content-type mismatch in files e2e test
• [Backport 18.6] Exclude Git HTTP requests from authenticated web throttle
• Backport “Fix Classic Duo Chat UI is stuck” into 18.6-stable-ee
• Backport of: Handle updated Jira API calls to permit Jira issue imports again
• Backport of Fix scan execution policy overriding YAML variables
• Backport (18.6): Update dependency @gitlab/web-ide to ^0.0.1-dev-20251210140521
• Backport of ‘Workhorse: use upstream for DWS API requests’
• Backport ‘Allow ClickHouse migrations to be skipped’
• Backport “Fix version-skipping upgrade blocker for namespace traversal IDs backfill”
• Backport of ‘Fix Elasticsearch pagination with null sortable field values’
• [18.6] Backport Mattermost Security Updates November 21, 2025
• [Backport - 18-6-stable] Disable allow_failure for the check-packages-functionality job in the tag pipelines
• Backport of ‘Fix 404 errors for Duo Workflow WS connection’

18.5.5

• Backport: Improve handling of attachment urls and filenames, fix undercoverage 18-5
• Backport of ‘Handle 429s during github LFS import’
• Backport of Dependency export fix
• Backport of ‘Add status filter argument to work items CSV export’
• 18.5 Backport: “Add type handling for findings with locations saved as Strings”
• Backport of Fix content and content-type mismatch in files e2e test
• [Backport 18.5] Exclude Git HTTP requests from authenticated web throttle
• Backport of: Handle updated Jira API calls to permit Jira issue imports again
• Backport(18.5): Update dependency @gitlab/web-ide to ^0.0.1-dev-20251210140521
• Backport of ‘Workhorse: use upstream for DWS API requests’
• [Backport - 18-5-stable] Disable allow_failure for the check-packages-functionality job in the tag pipelines
• Backport of ‘Fix 404 errors for Duo Workflow WS connection’

Important notes on upgrading

This patch includes database migrations that may impact your upgrade process.

Impact on your installation:

• Single-node instances: This patch will cause downtime during the upgrade as migrations must complete before GitLab can start.
• Multi-node instances: With proper zero-downtime upgrade procedures, this patch can be applied without downtime.

Post-deploy migrations

The following versions include post-deploy migrations that can run after the upgrade:

• 18.7.1
• 18.6.3

To learn more about the impact of upgrades on your installation, see:

• Zero-downtime upgrades for multi-node deployments
• Standard upgrades for single-node installations

Updating

To update GitLab, see the Update page. To update GitLab Runner, see the Updating the Runner page.

Receive Patch Notifications

To receive patch blog notifications delivered to your inbox, visit our contact us page. To receive release notifications via RSS, subscribe to our patch release RSS feed or our RSS feed for all releases.

On December 10, 2025, we released versions 18.6.2, 18.5.4, 18.4.6 for GitLab Community Edition (CE) and Enterprise Edition (EE).

These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action.

GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases: scheduled releases and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays. For more information, please visit our releases handbook and security FAQ. You can see all of GitLab release blog posts here.

For security fixes, the issues detailing each vulnerability are made public on our issue tracker 30 days after the release in which they were patched.

We are committed to ensuring that all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. To maintain good security hygiene, it is highly recommended that all customers upgrade to the latest patch release for their supported version. You can read more best practices in securing your GitLab instance in our blog post.

Recommended Action

We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible.

When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, it means all types are affected.

Security fixes

Table of security fixes

CVE-2025-12716 - Cross-site scripting issue in Wiki impacts GitLab CE/EE

GitLab has remediated an issue that, under certain conditions, could have allowed an authenticated user to perform unauthorized actions on behalf of another user by creating wiki pages with malicious content.

Impacted Versions: GitLab CE/EE: all versions from 18.4 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2
CVSS 8.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N)

Thanks yvvdwf for reporting this vulnerability through our HackerOne bug bounty program

CVE-2025-12029 - Cross-site scripting issue in Swagger UI impacts GitLab CE/EE

GitLab has remediated an issue that could have, under certain circumstances, allowed an unauthenticated user to perform unauthorized actions on behalf of another user by injecting malicious external scripts into the Swagger UI.

Impacted Versions: GitLab CE/EE: all versions from 15.11 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2
CVSS 8.0 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N)

Thanks x0abcd_ for reporting this vulnerability through our HackerOne bug bounty program

CVE-2025-8405 - Improper encoding in vulnerability reports impacts GitLab CE/EE

GitLab has remediated a security issue that could have allowed an authenticated user to perform unauthorized actions on behalf of other users by injecting malicious HTML into vulnerability code flow displays.

Impacted Versions: GitLab CE/EE: all versions from 17.1 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2
CVSS 7.7 (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N)

Thanks yvvdwf for reporting this vulnerability through our HackerOne bug bounty program

CVE-2025-12562 - Denial of service issue in GraphQL endpoints impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed an unauthenticated user to create a denial of service condition by sending crafted GraphQL queries that bypass query complexity limits.

Impacted Versions: GitLab CE/EE: all versions from 11.10 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2
CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Thanks joaxcar for reporting this vulnerability through our HackerOne bug bounty program

CVE-2025-11984 - Authentication bypass issue for WebAuthn users impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed an authenticated user to bypass WebAuthn two-factor authentication by manipulating the session state under certain conditions.

Impacted Versions: GitLab CE/EE: all versions from 13.1 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2
CVSS 6.8 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N)

Thanks jcarre for reporting this vulnerability through our HackerOne bug bounty program

CVE-2025-4097 - Denial of service issue in ExifTool processing impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed an authenticated user to cause a denial of service condition by uploading specially crafted images.

Impacted Versions: GitLab CE/EE: all versions from 11.10 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2
CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

CVE-2025-14157 - Denial of service issue in Commit API impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed an authenticated user to cause a Denial of Service condition by sending crafted API calls with large content parameters.

Impacted Versions: GitLab CE/EE: all versions from 6.3 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2
CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

This vulnerability has been discovered internally by GitLab team member Thong Kuah

CVE-2025-11247 - Information disclosure issue in compliance frameworks impacts GitLab EE

GitLab has remediated an issue that could have allowed a user to disclose sensitive information from private projects by executing specifically crafted GraphQL queries.

Impacted Versions: GitLab EE: all versions from 13.2 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2
CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

Thanks weasterhacker for reporting this vulnerability through our HackerOne bug bounty program

CVE-2025-13978 - Information disclosure through error messages impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed an authenticated user to discover the names of private projects they do not have access through API requests.

Impacted Versions: GitLab CE/EE: all versions from 17.5 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2
CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

This vulnerability has been discovered internally by GitLab team member Rohit Shambhuni

CVE-2025-12734 - HTML injection issue in merge request titles impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed an authenticated user to, under certain conditions, render content in dialogs to other users by injecting malicious HTML content into merge request titles.

Impacted Versions: GitLab CE/EE: all versions from 15.6 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2
CVSS 3.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N)

Thanks joaxcar for reporting this vulnerability through our HackerOne bug bounty program

Bug fixes

18.6.2

• [18.6] Backport - Fix gitlab-go build by updating Go download URL
• Update azcopy to v10.31.0 [Backport 18.6]
• Pipeline: Fixup gitlab-base version calculation 18-6 backport
• Backport of registration banner bugfix
• Backport of Ensure LFS imports work correctly with nil revisions
• Backport of ‘Fix OAuth for relative path’
• Remove redundant aria roles from recycle scroller (18.6 backport)
• Backport 18-6 Fix Duo Chat test to work with new feedback button UI
• [18.6] CI: bump DOCKER_VERSION to 28.5.2
• Update diff note representation
• Backport of ‘Bump test-tooling gem version to 3.1.0’
• Backport MR flaky test fix
• Backport of ‘GitHub importer fails to handle rate limits when importing note attachments’
• Backport Fix: Restore branch protection check in cache_suffix_for
• Backport of ‘Use Rust parser for tasklist parsing’
• Backport of Fix partition missing error in project_daily_statistics backfill (18.6)
• Backport of ‘Add migrations for missing merge_requests indexes for bigint’
• Backport of Make 4XX responses not retriable for attachment downloads 18-6
• Backport of ‘Handle 429s during github LFS import’
• 18-6 Stable Bump Container Registry to v4.31.1-gitlab
• Backport Pulp support to 18.6
• [18.6] Revert update to sshd_config mandating stronger algorithms
• [18.6] Fix RHEL 10 not working with SELinux
• Backport Pulp production release jobs to 18.6

18.5.4

• [18.5] Backport - Fix gitlab-go build by updating Go download URL
• Update azcopy to v10.31.0 [Backport 18.5]
• Pipeline: Fixup gitlab-base version calculation 18-5 backport
• middleware: Ignore non proto endpoints
• Backport of Ensure LFS imports work correctly with nil revisions
• Remove redundant aria roles from recycle scroller (18.5 backport)
• [18.5] CI: bump DOCKER_VERSION to 28.5.2
• Backport of registration banner bugfix
• Update diff note representation
• Backport of Fix partition missing error in project_daily_statistics backfill (18.5)
• Backport of ‘GitHub importer fails to handle rate limits when importing note attachments’
• Backport fix: Restore branch protection check in cache_suffix_for
• Backport Make 4XX responses not retriable for attachment downloads 18-5
• Backport Pulp support to 18.5
• Backport Pulp production release jobs to 18.5

18.4.6

• [18.4] Backport - Fix gitlab-go build by updating Go download URL
• Pipeline: Fixup gitlab-base version calculation 18-4 backport
• [18.4] CI: bump DOCKER_VERSION to 28.5.2
• Backport Fix: Restore branch protection check in cache_suffix_for
• Update diff note representation
• Backport of ‘GitHub importer fails to handle rate limits when importing note attachments’
• Backport Make 4XX responses not retriable for attachment downloads 18-4
• Backport of ‘Handle 429s during github LFS import’
• Backport Pulp support to 18.4
• Backport Pulp production release jobs to 18.4

Important notes on upgrading

This patch includes database migrations that may impact your upgrade process.

Impact on your installation:

• Single-node instances: This patch will cause downtime during the upgrade as migrations must complete before GitLab can start.
• Multi-node instances: With proper zero-downtime upgrade procedures, this patch can be applied without downtime.

Post-deploy migrations

The following versions include post-deploy migrations that can run after the upgrade:

• 18.6.2
• 18.5.4

To learn more about the impact of upgrades on your installation, see:

• Zero-downtime upgrades for multi-node deployments
• Standard upgrades for single-node installations

Updating

To update GitLab, see the Update page. To update GitLab Runner, see the Updating the Runner page.

Receive Patch Notifications

To receive patch blog notifications delivered to your inbox, visit our contact us page. To receive release notifications via RSS, subscribe to our patch release RSS feed or our RSS feed for all releases.

On November 26, 2025, we released versions 18.6.1, 18.5.3, 18.4.5 for GitLab Community Edition (CE) and Enterprise Edition (EE).

These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action.

GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases: scheduled releases and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays. For more information, please visit our releases handbook and security FAQ. You can see all of GitLab release blog posts here.

For security fixes, the issues detailing each vulnerability are made public on our issue tracker 30 days after the release in which they were patched.

We are committed to ensuring that all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. To maintain good security hygiene, it is highly recommended that all customers upgrade to the latest patch release for their supported version. You can read more best practices in securing your GitLab instance in our blog post.

Recommended Action

We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible.

When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, it means all types are affected.

Security fixes

Table of security fixes

CVE-2024-9183 - Race condition issue in CI/CD cache impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed an authenticated user to obtain credentials from higher-privileged users and perform actions in their context under specific conditions.

Impacted Versions: GitLab CE/EE: all versions from 18.4 before 18.4.5, 18.5 before 18.5.3, and 18.6 before 18.6.1
CVSS 7.7 (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N)

Thanks aphantom for reporting this vulnerability through our HackerOne bug bounty program

CVE-2025-12571 - Denial of Service issue in JSON input validation middleware impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed an unauthenticated user to cause a Denial of Service condition by sending specifically crafted requests containing malicious JSON payloads.

Impacted Versions: GitLab CE/EE: all versions from 17.10 before 18.4.5, 18.5 before 18.5.3, and 18.6 before 18.6.1
CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Thanks a92847865 for reporting this vulnerability through our HackerOne bug bounty program

CVE-2025-12653 - Authentication bypass issue in account registration impacts GitLab CE/EE

GitLab has remediated an issue that under specific conditions could have allowed an unauthenticated user to join arbitrary organizations by changing headers on some requests.

Impacted Versions: GitLab CE/EE: all versions from 18.3 before 18.4.5, 18.5 before 18.5.3, and 18.6 before 18.6.1
CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)

Thanks pwnie for reporting this vulnerability through our HackerOne bug bounty program

CVE-2025-7449 - Denial of Service issue in HTTP response processing impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed an authenticated user with specific permissions to cause a denial of service condition through HTTP response processing.

Impacted Versions: GitLab CE/EE: all versions from 8.3 before 18.4.5, 18.5 before 18.5.3, and 18.6 before 18.6.1
CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Thanks a92847865 for reporting this vulnerability through our HackerOne bug bounty program

CVE-2025-6195 - Improper authorization issue in markdown rendering impacts GitLab EE

GitLab has remediated an issue that could have allowed an authenticated user to view information from security reports under certain configuration conditions.

Impacted Versions: GitLab EE: all versions from 13.7 before 18.4.5, 18.5 before 18.5.3, and 18.6 before 18.6.1
CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

Thanks mateuszek for reporting this vulnerability through our HackerOne bug bounty program

CVE-2025-13611 - Information disclosure issue in terraform registry impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed an authenticated user with access to certain logs to obtain sensitive tokens under specific conditions.

Impacted Versions: GitLab CE/EE: all versions from 13.12 before 18.4.5, 18.5 before 18.5.3, and 18.6 before 18.6.1
CVSS 2.4 (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N)

Bug fixes

18.6.1

• 18-6 stable Bump Container Registry to v4.31.1-gitlab
• Backport of ‘Fix custom role approvers lookup for inherited users’
• [18.6] Fix /admin/sidekiq not loading CSS assets in Cloud Native GitLab
• Backport of ‘Rollout search_glql_use_routing flag’
• Backport of ‘Fix BackfillTimelogsNamespace finalization order’
• Backport ‘Move OAuth suite to test-on-cng’
• Backport ‘Fix commitsCount variable name’
• Backport 18-6 E2E test: quarantine long fast quarantined e2e tests
• Updating subscription tier for Security Analyst feature, bc it was incorrect
• Backport ‘Fix merge request widget polling race condition’
• Sidekiq role: Enable rails recipies by default [18.6 Backport]
• [18.6] Add nginx[‘default_server_enabled’] configuration parameter
• Backport: EL10 requires SELinux and perl packages

18.5.3

• Backport Zoekt rollout is not working properly if there is a single zoekt node available
• Backport of ‘Move support for license name to EE’
• Fix missing gitaly_context forward in BranchPushService
• Backport of ‘Split refresh worker into new workers’
• Backport of Add FF to eagerly resume jobs
• Backport of ‘Ensure project authorizations are updated on imported inheriting project memberships’
• E2E test: quarantine long time fast quarantined specs 18-5
• Backport of: Fix tags api first page pagination with search
• [Backport] Relax blobs complexity in favor of limiting data
• Backport of ‘Fix: prevent duplicate ‘?’ in Download directory URL (use ‘&’ for extra params)’
• Backport of ‘Update duo workflow service gem to 0.5’
• Backport of ‘Fix custom role approvers lookup for inherited users’
• [18.5] Fix /admin/sidekiq not loading CSS assets in Cloud Native GitLab
• Backport of ‘Support nested variables expention in rules:if’ into ‘master’
• Backport 18-5 E2E test: quarantine long fast quarantined e2e tests
• Backport ‘Fix merge request widget polling race condition’
• Sidekiq role: Enable rails recipies by default [18.5 Backport]
• [18.5] Add nginx[‘default_server_enabled’] configuration parameter
• Backport ‘fix-registry-commands-permission-for-non-docker’ into ‘18-5-stable’

18.4.5

• Backport Zoekt rollout is not working properly if there is a single zoekt node available
• Backport of ‘Move support for license name to EE’
• E2E test: quarantine long time fast quarantined specs 18-4
• Test: quarantine wiki specs 18-4
• Backport of: Fix tags api first page pagination with search
• [Backport] Relax blobs complexity in favor of limiting data
• [18.4] Fix /admin/sidekiq not loading CSS assets in Cloud Native GitLab
• Backport 18-4 E2E test: quarantine long fast quarantined e2e tests
• Bump eventmachine-tail gem to version 0.6.6
• Sidekiq role: Enable rails recipies by default [18.4 Backport]
• Backport ‘fix-registry-commands-permission-for-non-docker’ into ‘18-4-stable’

Important notes on upgrading

This patch includes database migrations that may impact your upgrade process.

Impact on your installation:

• Single-node instances: This patch will cause downtime during the upgrade as migrations must complete before GitLab can start.
• Multi-node instances: With proper zero-downtime upgrade procedures, this patch can be applied without downtime.

Post-deploy migrations

The following versions include post-deploy migrations that can run after the upgrade:

• 18.6.1

To learn more about the impact of upgrades on your installation, see:

• Zero-downtime upgrades for multi-node deployments
• Standard upgrades for single-node installations

Updating

To update GitLab, see the Update page. To update Gitlab Runner, see the Updating the Runner page.

Receive Patch Notifications

To receive patch blog notifications delivered to your inbox, visit our contact us page. To receive release notifications via RSS, subscribe to our patch release RSS feed or our RSS feed for all releases.

On November 12, 2025, we released versions 18.5.2, 18.4.4, 18.3.6 for GitLab Community Edition (CE) and Enterprise Edition (EE).

These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action.

GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases: scheduled releases and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays. For more information, please visit our releases handbook and security FAQ. You can see all of GitLab release blog posts here.

For security fixes, the issues detailing each vulnerability are made public on our issue tracker 30 days after the release in which they were patched.

We are committed to ensuring that all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. To maintain good security hygiene, it is highly recommended that all customers upgrade to the latest patch release for their supported version. You can read more best practices in securing your GitLab instance in our blog post.

Recommended Action

We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible.

When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, it means all types are affected.

Security fixes

Table of security fixes

CVE-2025-11224 - Cross-site scripting issue in k8s proxy impacts GitLab CE/EE

GitLab has remediated an issue that, under certain conditions, could have allowed an authenticated user to execute stored cross-site scripting through improper input validation in the Kubernetes proxy functionality.

Impacted Versions: GitLab CE/EE: all versions from 15.10 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2
CVSS 7.7 (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N)

Thanks joaxcar for reporting this vulnerability through our HackerOne bug bounty program

CVE-2025-11865 - Incorrect Authorization issue in workflows impacts GitLab EE

GitLab has remediated an issue that, under certain circumstances, could have allowed a user to remove Duo flows of another user.

Impacted Versions: GitLab EE: all versions from 18.1 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2
CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)

This vulnerability has been discovered internally by GitLab team member Dylan Griffith.

CVE-2025-2615 - Information Disclosure issue in GraphQL subscriptions impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed a blocked user to access sensitive information by establishing GraphQL subscriptions through WebSocket connections.

Impacted Versions: GitLab CE/EE: all versions from 16.7 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2
CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

Thanks rogerace for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2025-7000 - Information Disclosure issue in access control impacts GitLab CE/EE

GitLab has remdiated an issue in GitLab CE/EE that under specific conditions, could have allowed unauthorized users to view confidential branch names by accessing project issues with related merge requests.

Impacted Versions: GitLab CE/EE: all versions from 17.6 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2
CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

Thanks weasterhacker for reporting this vulnerability through our HackerOne bug bounty program

CVE-2025-6945 - Prompt Injection issue in GitLab Duo review impacts GitLab EE

GitLab has remediated an issue that could have allowed an authenticated user to leak sensitive information from confidential issues by injecting hidden prompts in merge request comments.

Impacted Versions: GitLab EE: all versions from 17.9 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2
CVSS 3.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N)

Thanks rogerace for reporting this vulnerability through our HackerOne bug bounty program

CVE-2025-11990 - Client Side Path Traversal issue in branch names impacts GitLab EE

GitLab has remediated an issue that could have allowed an authenticated user to gain CSRF tokens by exploiting improper input validation in repository references combined with redirect handling weaknesses.

Impacted Versions: GitLab EE: all versions from 18.4 before 18.4.4, and 18.5 before 18.5.2
CVSS 3.1 (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N)

Thanks swiftee for reporting this vulnerability through our HackerOne bug bounty program

CVE-2025-6171 - Information Disclosure issue in packages API endpoint impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed an authenticated user with reporter access to view branch names and pipeline details by accessing the packages API endpoint even when repository access was disabled.

Impacted Versions: GitLab CE/EE: all versions from 13.2 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2
CVSS 3.1 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N)

Thanks iamgk808 for reporting this vulnerability through our HackerOne bug bounty program

CVE-2025-7736 - Improper Access Control issue in GitLab Pages impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed an authenticated user to bypass access control restrictions and view GitLab Pages content intended only for project members by authenticating through OAuth providers.

Impacted Versions: GitLab CE/EE: all versions from 17.9 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2
CVSS 3.1 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N)

Thanks mateuszek for reporting this vulnerability through our HackerOne bug bounty program

CVE-2025-12983 - Denial of service issue in markdown impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed an authenticated user to cause a denial of service condition by submitting specially crafted markdown content with nested formatting patterns.

Impacted Versions: GitLab CE/EE: all versions from 16.9 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2
CVSS 3.1 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L)

Thanks phli for reporting this vulnerability through our HackerOne bug bounty program

libxslt security updates

libxslt has been updated to version 1.1.43 which contains fixes for security vulnerabilities including CVE-2024-55549 and CVE-2025-24855

Bug fixes

18.5.2

• [18.5] Backport of “Rails: Add explicit ClickHouse check skip”
• Backport of ‘rf-disable-sec-attribute-feature-flags’
• Backport E2E test: fix create project web ui 18-5
• 18.5 Backport of ‘Fix query for finding existing Jira issues for vulnerabilities’
• Backport of ‘Filter out group-level rules from details page’
• [18.5] Reduce cached SQL queries in /api/v4/internal/pages endpoint
• [18.5] Update dependency openssl to v3.3.2
• Update dependency simplecov-cobertura to v3
• Backport of Fix password validation exception for FIPS
• Backport of ‘Fix admin_project_member policy for SAML projects related to user namespaces’
• Backport of ‘Web Agentic Chat: fix calling workflowGoal on undefined’
• [Backport 18.5] Turn off Duo core widget for self-managed
• Backport of ‘Fix status mapping evaluation for non-persisted current status records’
• [18.5] Upgrade Rack to 2.2.20
• Backport of Elastic rake tasks projects_not_indexed and index_projects_status could be confusing
• Backport of ‘Add deleted Geo migration back’
• Backport of Allow Legacy FIPS instances to Upgrade Oauth secerets
• Backport of Zoekt Exclude forks and Include archived filters in the cache key
• [Backport 18.5] Clear tracking queues when recreating index from scratch
• [18.5 Backport] Delete failed reindexing indexes created over 30 days ago
• Backport of ‘Fix redirect loop in Gitea rate limit`
• [18.5 Backport] Set http_continue_timeout to nil for s3 client
• [18.5] Fix background migration when Ghost user is missing
• Backport Support Jira Cloud and Server issue fetching
• [18.5] Fix test failure by adjusting dates to match partition range
• Backport ‘Revert merge trains changes to getState GraphQL query’
• Backport ‘Update merge request widget polling timeout intervals’
• [18.5] Downgrade Zeitwerk to 2.6.18
• [Backport/18.5] of Fix instance bbm for mishandled nil verification token
• Fix NGINX not routing traffic to the right server
• [18.5] Uninstall rexml 3.4.0 and ensure 3.4.4 is used
• Update redis to v7.2.11
• Bump eventmachine-tail gem to version 0.6.6
• [18.5] Upgrade Rack to 2.2.20

18.4.4

• [18.4] Backport of “Rails: Add explicit ClickHouse check skip”
• [18.4] Reduce cached SQL queries in /api/v4/internal/pages endpoint
• [18.4] Update dependency openssl to v3.3.2
• Backports branch ’tachyons-remove-ff-sha512-oauth’ into ‘master’
• [18.4] Update rexml to v3.4.4
• Backport of Fix password validation exception for FIPS
• Backport of ‘Fix admin_project_member policy for SAML projects related to user namespaces’
• [Backport 18.4] Turn off Duo core widget for self-managed
• [18.4] Upgrade Rack to 2.2.20
• Backport of Elastic rake tasks projects_not_indexed and index_projects_status could be confusing
• Backport of ‘Add deleted Geo migration back’
• Backport of ‘Fix: prevent duplicate ‘?’ in Download directory URL (use ‘&’ for extra params)’
• Backport of Allow Legacy FIPS instances to Upgrade Oauth secrets
• Backport of ‘Fix redirect loop in Gitea rate limit’
• [18.4 Backport] Set http_continue_timeout to nil for s3 client
• Backport of Update Jira integration to use token-based pagination and Support Jira Cloud and Server issue fetching
• Backport ‘Revert merge trains changes to getState GraphQL query’
• Backport of Zoekt Exclude forks and Include archived filters in the cache key
• Backport ‘Update merge request widget polling timeout intervals’
• [Backport/18.4] of Fix instance bbm for mishandled nil verification token
• [18.4] Uninstall rexml 3.4.0 and ensure 3.4.4 is used
• Update redis to v7.2.11
• [18.4] Upgrade Rack to 2.2.20

18.3.6

• [18.3] Reduce cached SQL queries in /api/v4/internal/pages endpoint
• [18.3] Update dependency openssl to v3.3.2
• [18.3] Update rexml to v3.4.4
• [18.3] Upgrade Rack to 2.2.20
• [18.3 Backport] Set http_continue_timeout to nil for s3 client
• Backport of ‘Fix redirect loop in Gitea rate limit’
• Backport of Update Jira integration to use token-based pagination and Support Jira Cloud and Server issue fetching
• [18.3] Uninstall rexml 3.4.0 and ensure 3.4.4 is used
• Update redis to v7.2.11
• [18.3] Upgrade Rack to 2.2.20

Important notes on upgrading

This patch includes database migrations that may impact your upgrade process.

Impact on your installation:

• Single-node instances: This patch will cause downtime during the upgrade as migrations must complete before GitLab can start.
• Multi-node instances: With proper zero-downtime upgrade procedures, this patch can be applied without downtime.

Post-deploy migrations

The following versions include post-deploy migrations that can run after the upgrade:

• 18.5.2
• 18.4.4

To learn more about the impact of upgrades on your installation, see:

• Zero-downtime upgrades for multi-node deployments
• Standard upgrades for single-node installations

Updating

To update GitLab, see the Update page. To update Gitlab Runner, see the Updating the Runner page.

Receive Patch Notifications

To receive patch blog notifications delivered to your inbox, visit our contact us page. To receive release notifications via RSS, subscribe to our patch release RSS feed or our RSS feed for all releases.

On October 22, 2025, we released versions 18.5.1, 18.4.3, 18.3.5 for GitLab Community Edition (CE) and Enterprise Edition (EE).

These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action.

GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases: scheduled releases and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays. For more information, please visit our releases handbook and security FAQ. You can see all of GitLab release blog posts here.

For security fixes, the issues detailing each vulnerability are made public on our issue tracker 30 days after the release in which they were patched.

We are committed to ensuring that all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. To maintain good security hygiene, it is highly recommended that all customers upgrade to the latest patch release for their supported version. You can read more best practices in securing your GitLab instance in our blog post.

Recommended Action

We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible.

When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, it means all types are affected.

Security fixes

Table of security fixes

CVE-2025-11702 - Improper access control issue in runner API impacts GitLab EE

GitLab has remediated an issue that could have allowed an authenticated user with specific permissions to hijack project runners from other projects.

Impacted Versions: GitLab EE: all versions from 17.1 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1
CVSS 8.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H)

Thanks iamgk808 for reporting this vulnerability through our HackerOne bug bounty program

CVE-2025-10497 - Denial of service issue in event collection impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed an unauthenticated user to cause a denial of service condition by sending specially crafted payloads.

Impacted Versions: GitLab CE/EE: all versions from 17.10 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1
CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Thanks a92847865 for reporting this vulnerability through our HackerOne bug bounty program

CVE-2025-11447 - Denial of service issue in JSON validation impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed an unauthenticated user to cause a denial of service condition by sending GraphQL requests with crafted JSON payloads.

Impacted Versions: GitLab CE/EE: all versions from 11.0 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1
CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Thanks a92847865 for reporting this vulnerability through our HackerOne bug bounty program

CVE-2025-11974 - Denial of service issue in upload impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed an unauthenticated user to create a denial of service condition by uploading large files to specific API endpoints.

Impacted Versions: GitLab CE/EE: all versions from 11.7 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1
CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

This vulnerability has been discovered internally by GitLab team member David Fernandez

CVE-2025-11971 - Incorrect Authorization issue in pipeline builds impacts GitLab EE

GitLab has remediated an issue that could have allowed an authenticated user to trigger unauthorized pipeline executions by manipulating commits.

Impacted Versions: GitLab EE: all versions from 10.6 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1
CVSS 6.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N)

CVE-2025-6601 - Business logic error issue in group memberships impacts GitLab EE

GitLab has remediated an issue that under certain conditions could have allowed authenticated users to gain unauthorized project access by exploiting the access request approval workflow.

Impacted Versions: GitLab EE: all versions from 18.4 before 18.4.3 and 18.5 before 18.5.1
CVSS 3.8 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N)

Thanks mateuszek and rhidayahh for reporting this vulnerability through our HackerOne bug bounty program

CVE-2025-11989 - Missing authorization issue in quick actions impacts GitLab EE

GitLab has remediated an issue that could have allowed an authenticated user to execute unauthorized quick actions by including malicious commands in specific descriptions.

Impacted Versions: GitLab EE: all versions from 17.6 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1
CVSS 3.7 (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N)

This vulnerability has been discovered internally by GitLab team member Eva Kadlecová

Bug fixes

18.5.1

• [18.5] Downgrade redis-rb gem to v5.4.0
• [18.5] Fix connection pool errors when health check is running
• Backport: Test: dismiss duo popover
• Backport of ‘Fix work item status fallback to use lifecycle-aware default’
• Support stable branch pipelines (18.5 backport)

18.4.3

• pgbouncer: Use new bitnamilegacy container registry (18.4 backport)
• [18.4] Revert discarded database pool check in load balancer
• Backport ‘Fix group wiki inaccessible after deleting and creating group with the same name’
• Backport ElasticIndexBulkCronWorker throwing NoMethodError for epics
• [18.4] Fix Geo routes leaking to other specs
• Backport Allow Zoekt in Search API for blobs scope when Elasticsearch disabled
• Backport fix-agentic-chat-service-url-for-shm for 18.4 EE
• Backport Zoekt Kaminari raises an exception if total_count gets negative
• Backport (18.4) “Update dependency @gitlab/web-ide to ^0.0.1-dev-20250925110326”
• Backport branch ‘sh-fix-login-issues-ubuntu-fips’ into ‘master’
• Backport “Improve performance of ready to merge GraphQL query”
• [18.4] Fix flaky callout dismissal specs
• Backport: Ensure consistent approval permissions between UI, API and graphql
• Backport of ‘Show whitespace message when there’s nothing to show’
• [18.4] Downgrade redis-rb gem to v5.4.0
• [18.4] Fix connection pool errors when health check is running
• Backport ‘Remove available auto merge strategies from ready to merge query’
• 18.4 Backport of ‘Fix query for finding existing Jira issues for vulnerabilities’
• Backport: Test: dismiss duo popover
• Support stable branch pipelines (18.4 backport)

18.3.5

• pgbouncer: Use new bitnamilegacy container registry (18.3 backport)
• [18.3] Prevent session creation for sessionless users
• Backport of ‘Fix Start free trial link for self-managed instances’
• Backport ‘Fix SlackIntegration duplicate bug when inheriting from parent’ to 18.3
• Backport ElasticIndexBulkCronWorker throwing NoMethodError for epics
• Backport of ‘Recreate SlackIntegration records on descendant integration on update’
• [18.3] Fix json validation for elasticsearch_aws_role_arn
• [18.3] Fix flaky callout dismissal specs
• [18.3] Fix Geo routes leaking to other specs
• Backport (18.3) “Update dependency @gitlab/web-ide to ^0.0.1-dev-20250925110326”
• Backport of ‘Show whitespace message when there’s nothing to show’
• [18.3] Downgrade redis-rb gem to v5.4.0
• Backport: Test: dismiss duo popover 18-3
• Support stable branch pipelines (18.3 backport)

Important notes on upgrading

These versions do not include any new migrations, and for multi-node deployments, should not require any downtime.

Please be aware that by default the Omnibus packages will stop, run migrations, and start again, no matter how “big” or “small” the upgrade is. This behavior can be changed by adding a /etc/gitlab/skip-auto-reconfigure file, which is only used for updates.

Updating

To update GitLab, see the Update page. To update Gitlab Runner, see the Updating the Runner page.

Receive Patch Notifications

To receive patch blog notifications delivered to your inbox, visit our contact us page. To receive release notifications via RSS, subscribe to our patch release RSS feed or our RSS feed for all releases.

On October 8, 2025, we released versions 18.4.2, 18.3.4, 18.2.8 for GitLab Community Edition (CE) and Enterprise Edition (EE).

These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action.

GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases: scheduled releases and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays. For more information, please visit our releases handbook and security FAQ. You can see all of GitLab release blog posts here.

For security fixes, the issues detailing each vulnerability are made public on our issue tracker 30 days after the release in which they were patched.

We are committed to ensuring that all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. To maintain good security hygiene, it is highly recommended that all customers upgrade to the latest patch release for their supported version. You can read more best practices in securing your GitLab instance in our blog post.

Recommended Action

We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible.

When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, it means all types are affected.

Security fixes

Table of security fixes

CVE-2025-11340 - Incorrect authorization issue in GraphQL mutations impacts GitLab EE

GitLab has remediated an issue that, under certain conditions, could have allowed authenticated users with read-only API tokens to perform unauthorized write operations on vulnerability records by exploiting incorrectly scoped GraphQL mutations.
Impacted Versions: GitLab EE: all versions from 18.3 to 18.3.4, 18.4 to 18.4.2
CVSS: 7.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N)

This vulnerability has been discovered internally by GitLab team member Brian Williams.

CVE-2025-10004 - Denial of Service issue in GraphQL blob type impacts GitLab CE/EE

GitLab has remediated an issue that could make the GitLab instance unresponsive or degraded by sending crafted GraphQL queries requesting large repository blobs.
Impacted Versions: GitLab CE/EE: all versions from 13.12 to 18.2.8, 18.3 to 18.3.4, and 18.4 to 18.4.2
CVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Thanks pwnie for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2025-9825 - Missing authorization issue in manual jobs impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed authenticated users without project membership to view sensitive manual CI/CD variables by querying the GraphQL API.
Impacted Versions: GitLab CE/EE: all versions from 13.7 to 18.2.8, 18.3 before 18.3.4, and 18.4 before 18.4.2
CVSS: 5.0 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N)

Thanks joaxcar for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2025-2934 - Denial of Service issue in webhook endpoints impacts GitLab CE/EE

GitLab has remediated an issue impacting an upstream Ruby Core library that could have allowed an authenticated user to create a denial of service condition by configuring malicious webhook endpoints that send crafted HTTP responses. This issue was reported to Ruby Core maintainers on July 17, 2025.
Impacted Versions: GitLab CE/EE: all versions from 5.2 prior to 18.2.8, 18.3 prior to 18.3.4, and 18.4 prior to 18.4.2
CVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)

Thanks ppee for reporting this vulnerability through our HackerOne bug bounty program.

Bug fixes

18.4.2

• Backport of ‘Added safety chaining to pipeline helper’
• Workhorse: Improve large HTTP handling for DWS proxy
• Backport of ‘Fix: no implicit conversion of String into Array’ in Geo::Event workers
• Backport: Fix agentic chat
• [18.4] Clear detached partitions before tests run
• Backport ‘Fixes target projects endpoint 404 on compare revisions view’
• Transfer start and due dates data upon work item move or clone
• Backport of ‘Fix reassignment dropdown in CE’
• Transfer health status data upon work item move or clone
• Backport of Revert “Merge branch ‘ai-catalog-item-consumers-graphql’ into ‘master’”
• Backport of CI_MERGE_REQUEST_DIFF_BASE_SHA not updating on branch change
• Backport of “Use key-value structure in Release Environment MR label script”
• Backport of ‘Fix Start free trial link for self-managed instances’
• Update dependency gitlab-fog-azure-rm to ‘~> 2.4.0’
• Backport of ‘Remove non Saas instances from calling CDOT for trial duration’
• Backport of ‘Remove check_f02a3f53bf not null constraint’
• 18.4 backport of ‘Remove unknown licenses from sbom dependency list export’
• [18.4] Fix json validation for elasticsearch_aws_role_arn
• Backport: Change the model selection FF used for self managed
• [18.4] Prevent session creation for sessionless users
• Add a gitlab::config alias for package::config recipe

18.3.4

• Workhorse: Improve large HTTP handling for DWS proxy
• [18.3] Clear detached partitions before tests run
• Backport ‘Fixes target projects endpoint 404 on compare revisions view’
• Transfer start and due dates data upon work item move or clone
• Backport of ‘Fix reassignment dropdown in CE’
• Transfer health status data upon work item move or clone
• Backport of “Use key-value structure in Release Environment MR label script”
• Update dependency gitlab-fog-azure-rm to ‘~> 2.4.0’
• Backport of ‘Remove non Saas instances from calling CDOT for trial duration’
• 18.3 backport of ‘Remove unknown licenses from sbom dependency list export’
• Update docs hugo jobs’ image to use latest image

18.2.8

• [18.2] Allow elastic client adapter to be set
• [18.2] Clear detached partitions before tests run
• Transfer start and due dates data upon work item move or clone
• Backport of ‘Fix reassignment dropdown in CE’
• Transfer health status data upon work item move or clone
• Backport of “Use key-value structure in Release Environment MR label script”
• Update dependency gitlab-fog-azure-rm to ‘~> 2.4.0’
• [18.2] Fix json validation for elasticsearch_aws_role_arn
• 18.2 backport of ‘Remove unknown licenses from sbom dependency list export’
• Backport of ‘Fix Start free trial link for self-managed instances’
• Update docs hugo jobs’ image to use latest image

Important notes on upgrading

This patch includes database migrations that may impact your upgrade process.

Impact on your installation:

• Single-node instances: This patch will cause downtime during the upgrade as migrations must complete before GitLab can start.
• Multi-node instances: With proper zero-downtime upgrade procedures, this patch can be applied without downtime.

Post-deploy migrations

The following versions include post-deploy migrations that can run after the upgrade:

• 18.4.2

To learn more about the impact of upgrades on your installation, see:

• Zero-downtime upgrades for multi-node deployments
• Standard upgrades for single-node installations

Updating

To update GitLab, see the Update page. To update Gitlab Runner, see the Updating the Runner page.

Receive Patch Notifications

To receive patch blog notifications delivered to your inbox, visit our contact us page. To receive release notifications via RSS, subscribe to our patch release RSS feed or our RSS feed for all releases.

On September 25, 2025, we released versions 18.4.1, 18.3.3, 18.2.7 for GitLab Community Edition (CE) and Enterprise Edition (EE).

These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action.

GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases: scheduled releases and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays. For more information, please visit our releases handbook and security FAQ. You can see all of GitLab release blog posts here.

For security fixes, the issues detailing each vulnerability are made public on our issue tracker 30 days after the release in which they were patched.

We are committed to ensuring that all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. To maintain good security hygiene, it is highly recommended that all customers upgrade to the latest patch release for their supported version. You can read more best practices in securing your GitLab instance in our blog post.

Recommended Action

We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible.

When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, it means all types are affected.

Security fixes

Table of security fixes

CVE-2025-9642 - Cross-site scripting issue in Script Gadgets impacts GitLab CE/EE

GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute actions on behalf of other users by injecting malicious content.

Impacted Versions: GitLab CE/EE: all versions from 14.10 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1.
CVSS: 8.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Thanks joaxcar for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2025-10858 - Denial of Service issue when uploading specifically crafted JSON files impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed an unauthenticated user to render a GitLab instance unresponsive to legitimate users by sending specifically crafted JSON files.

Impacted versions: GitLab CE/EE: all versions before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1
CVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

CVE-2025-8014 - Denial of Service issue bypassing query complexity limits impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed an unauthenticated user to bypass query complexity limits leading to a Denial of Service condition.

Impacted versions: Gitlab EE/CE all versions from 11.10 prior to 18.2.7, 18.3 prior to 18.3.3, and 18.4 prior to 18.4.1
CVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Thanks foxribeye for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2025-9958 - Information disclosure issue in virtual registry configuration for low privileged users impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed low privileged users access to sensitive information stored in virtual registry configurations.

Impacted versions: GitLab CE/EE all versions from 14.10 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1
CVSS: 7.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)

Thanks joaxcar for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2025-7691 - Privilege Escalation issue from within the Developer role impacts GitLab EE

GitLab has remediated an issue that could have allowed a developer with specific group management permissions to escalate their privileges and obtain unauthorized access to additional system capabilities.

Impacted versions: GitLab EE all versions from 16.6 prior to 18.2.7, 18.3 prior to 18.3.3, and 18.4 prior to 18.4.1
CVSS: 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)

Thanks rogerace for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2025-11042 - Denial of Service issue in GraphQL API via Unbounded Array Parameters impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed an authenticated user to cause uncontrolled CPU consumption, potentially leading to a Denial of Service condition while using specific GraphQL queries.

Impacted versions: GitLab CE/EE all versions starting from 17.2 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1
CVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)

This vulnerability has been discovered internally by GitLab team member Alisa Frunza.

CVE-2025-10871 - Improper Authorization issue for Project Maintainers when assigning roles impacts GitLab EE

GitLab has remediated an issue that could allow Project Maintainers improper authorization to assign custom roles to users exceeding the Project Maintainer’s security boundary and achieving elevated privileges.

Impacted versions: GitLab EE all versions from 16.6 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1
CVSS: 3.8 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L)

This vulnerability was discovered internally by a GitLab team member, Diane Russel.

CVE-2025-10867 - Denial of Service issue in GraphQL API blobSearch impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed an authenticated user to create a Denial of Service condition by exploiting an unprotected GraphQL API through repeated requests.

Impacted versions: GitLab CE/EE all versions from 18.1 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1
CVSS: 3.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L)

This vulnerability has been discovered internally by GitLab team member Terri Chu

CVE-2025-5069 - Incorrect ownership assignment via Move Issue drop-down impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed an authenticated user to gain unauthorized access to confidential issues by creating a project with an identical name, potentially having users transfer sensitive information to the incorrect project.

Impacted versions: GitLab CE/EE all versions from 17.10 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1
CVSS: 3.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N)

Thanks foxribeye for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2025-10868 - Denial of Service issue via string conversion methods impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed an authenticated user to cause performance degradation, potentially leading to a Denial of Service condition with certain string conversion methods.

Impacted versions: GitLab CE/EE all versions from 17.4 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1
CVSS: 3.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L)

postgreSQL security updates

postgreSQL has been updated to version 16.10 which contains fixes for security vulnerabilities including CVE-2025-8713, CVE-2025-8714 and CVE-2025-8715

Bug fixes

18.4.1

• Backport of Update the admin user for GET Release Environment QA tests
• [18.4] Backport: Resolve “Unable to fork project or create project if application wide lock_duo_features_enabled is true”
• Backport of Add Danger message to guide backport MR authors to reviewers and mergers (18.4)
• Backport of ‘Prevent deleting group/project when ancestor is marked for deletion at the service level’
• 18.4: Backport of ‘Fix error when applying scanner suggestion’
• Backport of Ensure proper MCP URL OAuth Discovery for API/V4/MCP
• Fix database state leak across specs
• Optimize HandleMalformedStrings middleware for CPU and memory
• Backport protected branches dropdown copy fix to 18.4
• [18.4] Fix flaky parallel design management uploads spec
• Backport of (Fix FetchModelDefinitionsService) !205687
• Backport: Add documentation on how to add DUO_WORKFLOW_SELF_SIGNED_JWT__SIGNING_KEY for DAP installations
• Backport of ‘Geo: fix ActiveRecord::StatementInvalid: PG::UndefinedColumn when querying reverification count’
• Backport of Return success when status update target already matches
• [18.4] Allow elastic client adapter to be set
• Backport of Use isUnsafeLink for xcode protocol
• Ensure assets get recompiled if cached-assets-hash.txt is empty
• 18.4 Backport of ‘Resolve “Dependency list export with API silently fails license validation”’
• CI: Make Ubuntu 22.04 FIPS check EE-only (Backport)

18.3.3

• Backport ‘Bump default ruby version to 3.2.9’
• Backport of “Use release-environment project id instead of canonical”
• Backport of ‘Danger to not warn in maintained stable branches’ to 18.3
• Backport of “Upgrade duo workflow client protocol version”
• Backport of “Filter out duplicate values from the variable options dropdown”
• 18.3: Backport of ‘Fix security widget polling indefinitely when there are sboms’
• [18.3 backport] Remove CVE-2025-8714 commands from structure.sql
• Backport 18.3: Do not trim deployment filename in geo secondary
• [Backport-18.3]Wiki search throws 500 error for some wiki content
• [18.3] Fix search admin page error when ES server returns forbidden
• Backport of “Hide secrets manager settings behind feature flag instead of just the license” to 18.3
• Backport of Update the admin user for GET Release Environment QA tests
• [18.3] Backport: Resolve “Unable to fork project or create project if application wide lock_duo_features_enabled is true”
• Backport of Add Danger message to guide backport MR authors to reviewers and mergers (18.3)
• [Backport 18-3] Skip secret push protection for as-if-foss pipeline
• 18.3: Backport of ‘Fix error when applying scanner suggestion’
• Backport of Ensure proper MCP URL OAuth Discovery for API/V4/MCP
• Optimize HandleMalformedStrings middleware for CPU and memory
• Backport to 18.3 of Add job project claims to CI ID Tokens
• Backport of Return success when status update target already matches
• [18.3] Fix flaky parallel design management uploads spec
• Backport ‘Fix branches autocomplete paths in the merge request list app’ to 18-3
• Backport ‘Fix Linked file not being on top of the list’ to 18-3
• [18.3] Allow elastic client adapter to be set
• Backport of Use isUnsafeLink for xcode protocol
• 18.3 Backport of ‘Resolve “Dependency list export with API silently fails license validation”’
• Backport: Fix registry matadata database password creation
• Fall back to c_rehash if there are multiple TLS certificates

18.2.7

• Backport of diff comment suggestions line range fix
• [18.2] Fix search admin page error when ES server returns forbidden
• [Backport 18.2] Wiki search throws 500 error for some wiki content
• Backport of ‘Danger to not warn in maintained stable branches’ to 18.2
• Backport 18.2: Do not trim deployment filename in geo secondary
• Backport of “Use release-environment project id instead of canonical”
• 18.2: Backport of ‘Fix security widget polling indefinitely when there are sboms’
• Backport of Update the admin user for GET Release Environment QA tests
• [Backport 18-2] Skip secret push protection for as-if-foss pipeline
• Backport of Add Danger message to guide backport MR authors to reviewers and mergers (18.2)
• 18.2: Backport of ‘Fix error when applying scanner suggestion’
• Optimize HandleMalformedStrings middleware for CPU and memory
• Backport to 18.2 of Add job project claims to CI ID Tokens
• [18.2] Backport: Resolve “Unable to fork project or create project if application wide lock_duo_features_enabled is true”
• [18.2] Fix flaky parallel design management uploads spec
• Fall back to c_rehash if there are multiple TLS certificates

Important notes on upgrading

These versions do not include any new migrations, and for multi-node deployments, should not require any downtime.

Please be aware that by default the Omnibus packages will stop, run migrations, and start again, no matter how “big” or “small” the upgrade is. This behavior can be changed by adding a /etc/gitlab/skip-auto-reconfigure file, which is only used for updates.

Updating

To update GitLab, see the Update page. To update Gitlab Runner, see the Updating the Runner page.

Receive Patch Notifications

To receive patch blog notifications delivered to your inbox, visit our contact us page. To receive release notifications via RSS, subscribe to our patch release RSS feed or our RSS feed for all releases.

On September 10, 2025, we released versions 18.3.2, 18.2.6, 18.1.6 for GitLab Community Edition (CE) and Enterprise Edition (EE).

These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action.

GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases: scheduled releases and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays. For more information, please visit our releases handbook and security FAQ. You can see all of GitLab release blog posts here.

For security fixes, the issues detailing each vulnerability are made public on our issue tracker 30 days after the release in which they were patched.

We are committed to ensuring that all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. To maintain good security hygiene, it is highly recommended that all customers upgrade to the latest patch release for their supported version. You can read more best practices in securing your GitLab instance in our blog post.

Recommended Action

We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible.

When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, it means all types are affected.

Security fixes

Table of security fixes

CVE-2025-2256 - Denial of Service issue in SAML Responses impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed unauthorized users to render the GitLab instance unresponsive to legitimate users by sending multiple concurrent large SAML responses.

Impacted Versions: GitLab CE/EE: all versions from 7.12 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2
CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Thanks yuki_osaki for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2025-6454 - Server-Side Request Forgery issue in Webhook custom header impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed authenticated users to make unintended internal requests through proxy environments by injecting crafted sequences.

Impacted Versions: GitLab CE/EE: all versions from 16.11 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2
CVSS 8.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H)

Thanks ppee for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2025-1250 - Denial of Service issue in User-Controllable Fields impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed an authenticated user to stall background job processing by sending specially crafted commit messages, merge request descriptions, or notes.

Impacted Versions: GitLab CE/EE: all versions from 15.0 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2
CVSS: 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Thanks pwnie for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2025-7337 - Denial of Service issue in endpoint file upload impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed an authenticated user with Developer-level access to cause a persistent denial of service affecting all users on a GitLab instance by uploading large files.

Impacted Versions: GitLab CE/EE: all versions from 7.8 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2
CVSS: 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Thanks pwnie for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2025-10094 - Denial of Service issue in token listing operations impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed authenticated users to disrupt access to token listings and related administrative operations by creating tokens with excessively large names.

Impacted Versions: GitLab CE/EE: all versions from 10.7 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2
CVSS: 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Thanks pwnie for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2025-6769 - Information disclosure issue in runner endpoints impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed authenticated users to view administrator-only maintenance notes by accessing runner details through specific interfaces.

Impacted Versions: GitLab CE/EE: all versions from 15.1 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2
CVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

Thanks iamgk808 for reporting this vulnerability through our HackerOne bug bounty program.

Bug fixes

18.3.2

• Backport of ‘Ignore silent_mode in clickhouse http calls’
• Backport of ‘Update gitlab-shell to v14.45.0’
• Revert “Merge branch ‘marina.mosti-543725-reviewer-dropdown-ce’ into ‘master’”
• Backport of “Only create ToC for headings with links”
• Backport of fix webauthn authentication in Firefox - 18.3
• Backport of move delayed deletion cronjob settings to CE
• Backport ‘Disable gdk-update job in stable branch pipelines’
• Backport update to gitlab-sshd to relax allowed algorithms for FIPS
• Backport of ‘Display MCP settings for root groups only’
• Backport of ‘Fix shared group access for advanced code search’
• Backport: Fix nil error in Gitlab:Auth:IpRateLimiter
• Backport ‘Add Compare link to submodule diffs’ to 18.3
• Backport of “Revert ‘New projects don’t automatically inherit from group-level’”
• Backport of “Fix syncing remote stored Blobs with filenames with plus sign”
• Backport of ‘Make FileLocationType.endLine nullable’ for 18.3
• Backport of Update csp_enabled? to always return a boolean value
• Backport of Fix LdapAllAddOnSeatSyncWorker removing seats when no groups configured
• Backport ‘Revert gem caching only in specific pipelines’
• Update gitlab-shell to v14.45.2 to allow ED25519 for FIPS
• [18.3] Remove flaky spec
• Backport of diff comment suggestions line range fix
• Adds checksum for ruby 3.2.9

18.2.6

• Update gitlab-shell to v14.45.0
• Backport of “Only create ToC for headings with links”
• Backport update to gitlab-sshd to relax allowed algorithms for FIPS
• Backport ‘Disable gdk-update job in stable branch pipelines’
• Backport of ‘Fix shared group access for advanced code search’
• Backport of ‘Fix Bitbucket Server Importer enqueued job count’
• Backport of ‘Fix: Geo::ModelMapper flakiness’
• Backport ‘Add Compare link to submodule diffs’ to 18.2
• Backport of ‘Make FileLocationType.endLine nullable’ for 18.2
• Backport of Update csp_enabled? to always return a boolean value
• Backport of “Fix syncing remote stored Blobs with filenames with plus sign”
• Update gitlab-shell to v14.45.2 to allow ED25519 for FIPS
• [18.2] Remove flaky spec
• Backport 18-2: Fix spec tag name source

18.1.6

• Backport of ‘Fix cannot load such file – gitlab’
• Backport of Fix ‘Bitbucket Server Importer enqueued job count’
• Backport of ‘Make FileLocationType.endLine nullable’ for 18.1

Important notes on upgrading

These versions do not include any new migrations, and for multi-node deployments, should not require any downtime.

Please be aware that by default the Omnibus packages will stop, run migrations, and start again, no matter how “big” or “small” the upgrade is. This behavior can be changed by adding a /etc/gitlab/skip-auto-reconfigure file, which is only used for updates.

Updating

To update GitLab, see the Update page. To update Gitlab Runner, see the Updating the Runner page.

Receive Patch Notifications

To receive patch blog notifications delivered to your inbox, visit our contact us page. To receive release notifications via RSS, subscribe to our patch release RSS feed or our RSS feed for all releases.

On August 27, 2025, we released versions 18.3.1, 18.2.5, 18.1.5 for GitLab Community Edition (CE) and Enterprise Edition (EE).

These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action.

GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases: scheduled releases and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays. For more information, please visit our releases handbook and security FAQ. You can see all of GitLab release blog posts here.

For security fixes, the issues detailing each vulnerability are made public on our issue tracker 30 days after the release in which they were patched.

We are committed to ensuring that all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. To maintain good security hygiene, it is highly recommended that all customers upgrade to the latest patch release for their supported version. You can read more best practices in securing your GitLab instance in our blog post.

Recommended Action

We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible.

When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, it means all types are affected.

Security fixes

Table of security fixes

CVE-2025-3601 - Allocation of Resources Without Limits issue in import function impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed an authenticated user to cause a Denial of Service (DoS) condition by submitting URLs that generate excessively large responses.

Impacted Versions: GitLab CE/EE: all versions from 8.15 before 18.1.5, 18.2 before 18.2.5, and 18.3 before 18.3.1
CVSS: 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Thanks nermalt for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2025-2246 - Missing authentication issue in GraphQL endpoint impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed unauthenticated users to access sensitive manual CI/CD variables by querying the GraphQL API.

Impacted Versions: GitLab CE/EE: all versions before 18.1.5, 18.2 before 18.2.5, and 18.3 before 18.3.1
CVSS: 5.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N)

Thanks pwnie for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2025-4225 - Allocation of Resources Without Limits issue in GraphQL impacts GitLab CE/EE

GitLab has remediated an issue that under certain conditions could have allowed an unauthenticated attacker to cause a denial-of-service condition affecting all users by sending specially crafted GraphQL requests.

Impacted Versions: GitLab CE/EE: all versions from 14.1 before 18.1.5, 18.2 before 18.2.5, and 18.3 before 18.3.1
CVSS: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

Thanks pwnie for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2025-5101 - Code injection issue in GitLab repositories impacts GitLab CE/EE

GitLab has remediated an issue that under certain conditions could have allowed an authenticated attacker to distribute malicious code that appears harmless in the web interface by taking advantage of ambiguity between branches and tags during repository imports.

Impacted Versions: GitLab CE/EE: all versions before 18.1.5, 18.2 before 18.2.5, and 18.3 before 18.3.1
CVSS: 5.0 (CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:N/I:H/A:N).

Thanks st4nly0n for reporting this vulnerability through our HackerOne bug bounty program.

Bug fixes

18.3.1

• [Backport 18.3] Making changes for container scanning for SBOMs
• Backport of ‘Fix cannot load such file – gitlab’
• Backport: Fix namespace issue preventing Ci::Build filtering optimization
• Backport of “Dependency Path creation with path caching”
• Fix trusted proxies regression when hostname is specified
• Backport of E2E test: use correct checkbox method
• Update Mattermost to v10.10.2

18.2.5

• [Backport 18.2] Making changes for container scanning for SBOMs
• [18.2] Fix flaky specs due to label ordering
• Backport ‘Danger to fail backport MRs without descriptive title’
• Backport bug - Fix mutations of frozen object in feature_setting.rb
• Add stage check for agentic chat
• Backport of ‘update the active_add_on_purchase check to include self-managed check’
• Backport of “Create noop pipeline template compatible with test-on-omnibus”
• Backport of ‘Fix cannot load such file – gitlab’
• Backport of E2E test: use correct checkbox method
• Backport of ‘Ignore silent_mode in clickhouse http calls’

18.1.5

• Backport “Danger to not error when e2e:test-on-omnibus-ee job not present for only QA changes” to 18.1
• Backport Set :throttled urgency for GlobalAdvisoryScanWorker
• Backport ‘Add job and script to update backport MR label after deployment’
• Backport ‘Update gitlab-chart digest to 9d9e150’
• Backport of ‘fix missing ref attribute’
• [18.1] Fix flaky specs due to label ordering
• Backport ‘Danger to fail backport MRs without descriptive title’
• Backport of ‘update the active_add_on_purchase check to include self-managed check’
• Backport of E2E test: use correct checkbox method
• Backport of “Create noop pipeline template compatible with test-on-omnibus”

Important notes on upgrading

These versions do not include any new migrations, and for multi-node deployments, should not require any downtime.

Please be aware that by default the Omnibus packages will stop, run migrations, and start again, no matter how “big” or “small” the upgrade is. This behavior can be changed by adding a /etc/gitlab/skip-auto-reconfigure file, which is only used for updates.

Updating

To update GitLab, see the Update page. To update Gitlab Runner, see the Updating the Runner page.

Receive Patch Notifications

To receive patch blog notifications delivered to your inbox, visit our contact us page. To receive release notifications via RSS, subscribe to our patch release RSS feed or our RSS feed for all releases.

On August 18, 2025, we released versions 18.2.4 for GitLab Community Edition and Enterprise Edition.

These versions resolve a number of regressions and bugs. This patch release does not include any security fixes.

GitLab Community Edition and Enterprise Edition

18.2.4

• Build with Go 1.24.5
• Update golang-fips/go
• Update gitlab-shell to v14.44.0
• Backport “Use projectRootPath to compose breadcrumb links”
• Backport “Add custom encoding for repository path for commit data”
• Backport ‘Fixes reviewer drawer not opening when installed under relative URL’
• Backport-Invalid search request resets the project/group selections in sidebar
• Backport ‘Update gitlab-chart digest to 9d9e150’
• Exclude deleted projects from job token authorization logs graphql and csv export service backport to 18.2
• Backport ‘Add job and script to update backport MR label after deployment’
• Backport of “Fix undefined method markdown_placeholders_feature_flag_enabled? for a ProjectNamespace”
• Backport of ‘fix missing ref attribute’

Important notes on upgrading

This version does not include any new migrations, and for multi-node deployments, should not require any downtime.

Please be aware that by default the Omnibus packages will stop, run migrations, and start again, no matter how “big” or “small” the upgrade is. This behavior can be changed by adding a /etc/gitlab/skip-auto-reconfigure file, which is only used for updates.

Updating

To update, check out our update page.

Note: GitLab releases have skipped 18.2.3. There is no patch with that version number.

GitLab subscriptions

Access to GitLab Premium and Ultimate features is granted by a paid subscription.

Alternatively, sign up for GitLab.com to use GitLab’s own infrastructure.

On August 15, 2025, we released version 17.11.7 for GitLab Community Edition and Enterprise Edition.

These versions resolve a number of regressions and bugs. This patch release does not include any security fixes.

GitLab Community Edition and Enterprise Edition

17.11.7

• Backport ‘Replace test-on-gdk with test-on-cng in backport mr pipelines’
• Quarantine failing DORA Metrics dashboard tests (target single context)
• Backport of “Ensure docs hugo_build CI job uses docs-gitlab-com stable branches”
• Backport of ‘Make sure cache is clear to prevent failure during upgrade from 17.11’
• Update dependency container-registry to v4.19.2-gitlab

Important notes on upgrading

This version does not include any new migrations, and for multi-node deployments, should not require any downtime.

Please be aware that by default the Omnibus packages will stop, run migrations, and start again, no matter how “big” or “small” the upgrade is. This behavior can be changed by adding a /etc/gitlab/skip-auto-reconfigure file, which is only used for updates.

Updating

To update, check out our update page.

GitLab subscriptions

Access to GitLab Premium and Ultimate features is granted by a paid subscription.

Alternatively, sign up for GitLab.com to use GitLab’s own infrastructure.

On August 13, 2025, we released versions 18.2.2, 18.1.4, 18.0.6 for GitLab Community Edition (CE) and Enterprise Edition (EE).

These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action.

GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases: scheduled releases and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays. For more information, please visit our releases handbook and security FAQ. You can see all of GitLab release blog posts here.

For security fixes, the issues detailing each vulnerability are made public on our issue tracker 30 days after the release in which they were patched.

We are committed to ensuring that all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. To maintain good security hygiene, it is highly recommended that all customers upgrade to the latest patch release for their supported version. You can read more best practices in securing your GitLab instance in our blog post.

Recommended Action

We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible.

When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, it means all types are affected.

Security fixes

Table of security fixes

CVE-2025-7734 - Cross-site scripting issue in blob viewer impacts GitLab CE/EE

GitLab has remediated an issue that, under certain conditions, could have allowed a successful attacker to execute actions on behalf of users by injecting malicious content.

Impacted Versions: GitLab CE/EE: all versions from 14.2 before 18.0.6, 18.1 before 18.1.4 and 18.2 before 18.2.2
CVSS: 8.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N)

Thanks joaxcar for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2025-7739 - Cross-site scripting issue in labels impacts GitLab CE/EE

GitLab has remediated an issue that, under certain conditions, could have allowed authenticated users to achieve stored cross-site scripting by injecting malicious HTML content in scoped label descriptions.

Impacted Versions: GitLab CE/EE: all versions from 18.2 before 18.2.2
CVSS: 8.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N)

Thanks yvvdwf for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2025-6186 - Cross-site scripting issue in Workitem impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed authenticated users to achieve account takeover by injecting malicious HTML into work item names.

Impacted Versions: GitLab CE/EE: all versions from 18.1 before 18.1.4, and 18.2 before 18.2.2
CVSS: 8.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N)

Thanks joaxcar for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2025-8094 - Improper Handling of Permissions issue in project API impacts GitLab CE/EE

GitLab has remediated an issue that under certain conditions could have allowed authenticated users with maintainer privileges to cause denial of service to other users’ CI/CD pipelines by manipulating shared infrastructure resources beyond their intended access level.

Impacted Versions: GitLab CE/EE: all versions 18.0 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2
CVSS: 7.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H)

Thanks abdelrahman_maged for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2024-12303 - Incorrect Privilege Assignment issue in delete issues operation impacts GitLab CE/EE

GitLab has remediated an issue that under certain conditions could have allowed authenticated users with specific roles and permissions to delete issues including confidential ones by inviting users with a specific role.

Impacted Versions: GitLab CE/EE: all versions from 17.7 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2
CVSS: 6.7 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L)

Thanks yuki_osaki for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2025-2614 - Allocation of Resources Without Limits issue in release name creation impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed an authenticated user to cause a denial of service condition by creating specially crafted content that consumes excessive server resources when processed.

Impacted Versions: GitLab CE/EE: all versions from 11.6 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2
CVSS: 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Thanks pwnie for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2024-10219 - Incorrect Authorization issue in jobs API impacts GitLab CE/EE

GitLab has remediated an issue that under certain conditions could have allowed authenticated users to bypass access controls and download private artifacts by accessing specific API endpoints.

Impacted Versions: GitLab CE/EE: all versions from 15.6 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2
CVSS: 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

Thanks albatraoz for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2025-8770 - Authorization issue in Merge request approval policy impacts GitLab EE

GitLab has remediated an issue that could have allowed authenticated users with specific access to bypass merge request approval policies by manipulating approval rule identifiers.

Impacted Versions: GitLab EE: all versions from 18.0 prior to 18.0.6, 18.1 prior to 18.1.4, and 18.2 prior to 18.2.2
CVSS: 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)

This vulnerability has been discovered internally by GitLab team member Dominic Bauer.

CVE-2025-2937 - Inefficient Regular Expression Complexity issue in wiki impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed authenticated users to create a denial of service condition by sending specially crafted markdown payloads to the Wiki feature.

Impacted Versions: GitLab CE/EE: all versions from 13.2 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2
CVSS: 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Thanks yuki_osaki for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2025-1477 - Allocation of Resources Without Limits issue in Mattermost integration impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed an unauthenticated user to create a denial of service condition by sending specially crafted payloads to specific integration API endpoints.

Impacted Versions: GitLab CE/EE: all versions from 8.14 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2
CVSS: 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Thanks pwnie for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2025-5819 - Incorrect Permission Assignment issue in ID token impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed authenticated users with developer access to obtain ID tokens for protected branches under certain circumstances.

Impacted Versions: GitLab CE/EE: all versions from 15.7 before 17.11.6, 18.0 before 18.0.4, and 18.1 before 18.1.2
CVSS: 5.0 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N)

Thanks skybound for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2025-2498 - Insufficient Access Control issue in IP Restriction impacts GitLab EE

GitLab has remediated an issue that under certain conditions could have allowed users to view assigned issues from restricted groups by bypassing IP restrictions.

Impacted Versions: GitLab EE: all versions from 12.0 prior to 18.0.6, 18.1 prior to 18.1.4, and 18.2 prior to 18.2.2
CVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

Thanks rogerace for reporting this vulnerability through our HackerOne bug bounty program.

Bug fixes

18.2.2

• [backport] bug: Fixed double message bug
• Backport of ‘Remove full instance test suite execution from omnibus pipeline’
• Backport ‘Replace test-on-gdk with test-on-cng in backport mr pipelines’
• [18.2] Fix hardcoded GitLab version in spec
• Backport of ‘Exclude release environments from QA live envs’
• [18.2 backport] Fix flaky epic deletion specs
• [Backport 18.2] Add pause_control to Elastic delete workers
• Backport of Skip Geo secondary for SyncProjectPolicyWorker
• Backport of “Add outbound allowlist to allowed endpoints for SSRF filter”
• Backport of Revert “Remove FF for SSRF protection for dependency proxy”
• Backport of ‘New projects inherit parent value for duo_features_enabled’
• Backport of ‘Add missing elasticsearch_indexing checks to workers’
• [18.2] Fix flaky work item spec
• [backport] of Fix: include relative URL root in PDF worker and cMap paths
• Ensure docs hugo_build CI job uses docs-gitlab-com stable branches
• Backport of ‘Fix: validation errors for Duo settings when creating project’
• Backport quarantine broken user signups cap alert test
• Backport ruby gem caching improvements
• Fix another case where Sidekiq can take too long to shut down
• Backport of ‘Filter out NULL values’
• Backport ‘Decouple node-modules caching from any specific branch’
• Backport of ‘Simplify db:check-schema CI job’
• backport fix to use right primary key for ci_job_artifact_states
• [Backport 18.2] Fix shared group access in advanced search code scope
• Backport ‘Danger to allow backport of maintenance type changes’ to 18-2
• backport: Fix Web IDE loading race condition
• Backport of Fix numpad enter not working for revision compare dropdown
• Backport[18.2]: Removing check for project and framework for self managed instances
• Backport fix case insensitivity in codeowners
• [18.2] Fix flaky note scope spec
• Backport 556582-link-to-project-not-working-when-gitlab-hosted-in-subpath-after-upgrade-to-18-2
• Backport fix: Detect CORS problems in Web IDE
• Backport “Danger to not error when e2e:test-on-omnibus-ee job not present for only QA changes” to 18.2
• Backport “Use projectRootPath to compose breadcrumb links”
• Backport of ‘Use CI_COMMIT_TAG to check on_tag?’
• Fix deprecation check failing on nil values

18.1.4

• Backport of ‘Remove full instance test suite execution from omnibus pipeline’
• Backport ‘Replace test-on-gdk with test-on-cng in backport mr pipelines’
• [18.1 backport] Fix flaky epic deletion specs
• Backport of ‘Exclude release environments from QA live envs’
• Backport of Skip Geo secondary for SyncProjectPolicyWorker
• [Backport 18.1] Add pause_control to Elastic delete workers
• Backport of Revert “Remove FF for SSRF protection for dependency proxy”
• Backport of “Update VERSION file for 18.1.3-internal0”
• Backport of ‘Add missing elasticsearch_indexing checks to workers’
• [18.1] Fix flaky work item spec
• [backport] of Fix: include relative URL root in PDF worker and cMap paths
• Backport of “Add repair index tool”, Backport of “Filter out NULL values”, Backport of “Add documentation for IndexRepair task”
• Ensure docs hugo_build CI job uses docs-gitlab-com stable branches
• Backport ruby gem caching improvements
• Fix another case where Sidekiq can take too long to shut down
• Backport of ‘Simplify db:check-schema CI job’
• Backport ‘Decouple node-modules caching from any specific branch’
• backport fix to use right primary key for ci_job_artifact_states
• Backport of Fix numpad enter not working for revision compare dropdown
• Backport ‘Danger to allow backport of maintenance type changes’ to 18-1
• Backport[18.1]: Removing check for project and framework for self managed instances
• Backport “Use projectRootPath to compose breadcrumb links”
• Backport fix case insensitivity in codeowners
• Backport of ‘Use CI_COMMIT_TAG to check on_tag?’

18.0.6

• [18.0 backport] Fix flaky epic deletion specs
• Backport of ‘Exclude release environments from QA live envs’
• Backport of ‘Run QA on GET release environment’
• [Backport 18.0] Add pause_control to Elastic delete workers
• [18.0] Fix flaky work item spec
• Ensure docs hugo_build CI job uses docs-gitlab-com stable branches
• Fix another case where Sidekiq can take too long to shut down
• Backport of “Add repair index tool”, Backport of “Filter out NULL values”, Backport of “Add documentation for IndexRepair task”
• Backport of ‘Simplify db:check-schema CI job’
• [backport] ’tbulva-zoekt-url-reset’ into 18.0
• backport fix to use right primary key for ci_job_artifact_states
• Backport ruby gem caching improvements
• Backport ‘Danger to allow backport of maintenance type changes’ to 18-0
• Backport[18.0] Removing check for project and framework for self managed instances
• Backport ‘Decouple node-modules caching from any specific branch’
• Backport fix case insensitivity in codeowners
• Backport of ‘Use CI_COMMIT_TAG to check on_tag?’

Important notes on upgrading

This patch includes database migrations that may impact your upgrade process.

Impact on your installation:

• Single-node instances: This patch will cause downtime during the upgrade as migrations must complete before GitLab can start.
• Multi-node instances: With proper zero-downtime upgrade procedures, this patch can be applied without downtime.

Regular migrations

The following versions include regular migrations that run during the upgrade process:

• 18.2.2
• 18.1.4
• 18.0.6

Post-deploy migrations

The following versions include post-deploy migrations that can run after the upgrade:

• 18.2.2
• 18.1.4
• 18.0.6

To learn more about the impact of upgrades on your installation, see:

• Zero-downtime upgrades for multi-node deployments
• Standard upgrades for single-node installations

Updating

To update GitLab, see the Update page. To update Gitlab Runner, see the Updating the Runner page.

Receive Patch Notifications

To receive patch blog notifications delivered to your inbox, visit our contact us page. To receive release notifications via RSS, subscribe to our patch release RSS feed or our RSS feed for all releases.

On July 23, 2025, we released versions 18.2.1, 18.1.3, 18.0.5 for GitLab Community Edition (CE) and Enterprise Edition (EE).

These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action.

GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases: scheduled releases and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays. For more information, please visit our releases handbook and security FAQ. You can see all of GitLab release blog posts here.

For security fixes, the issues detailing each vulnerability are made public on our issue tracker 30 days after the release in which they were patched.

We are committed to ensuring that all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. To maintain good security hygiene, it is highly recommended that all customers upgrade to the latest patch release for their supported version. You can read more best practices in securing your GitLab instance in our blog post.

Recommended Action

We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible.

When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, it means all types are affected.

Security fixes

Table of security fixes

CVE-2025-4700 - Cross-site scripting issue impacts Kubernetes Proxy in GitLab CE/EE

GitLab has remediated an issue affecting a Kubernetes proxy feature that, under specific circumstances, could have potentially allowed a successful attacker to trigger unintended content rendering leading to XSS.

Impacted Versions: GitLab CE/EE: all versions from 15.10 before 18.0.5, 18.1 before 18.1.3, and 18.2 before 18.2.1.
CVSS: 8.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N)

Thanks joaxcar for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2025-4439 - Cross-site scripting issue impacts Kubernetes Proxy in GitLab CE/EE using CDNs

GitLab has remediated an issue that could have allowed an authenticated user to perform cross-site scripting attacks when the instance is served through certain content delivery networks.

Impacted Versions: GitLab CE/EE: all versions from 15.10 before 18.0.5, 18.1 before 18.1.3, and 18.2 before 18.2.1.
CVSS: 7.7 (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N)

Thanks joaxcar for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2025-7001 - Exposure of Sensitive Information to an Unauthorized Actor issue impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed privileged users to access certain resource_group information through the API which should have been unavailable.

Impacted Versions: GitLab CE/EE: all versions from 15.0 before 18.0.5, 18.1 before 18.1.3, and 18.2 before 18.2.1.
CVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

Thanks iamgk808 for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2025-4976 - Improper Access Control issue impacts GitLab EE

GitLab has remediated an issue that, under certain circumstances, could have allowed an attacker to access internal notes in GitLab Duo responses.

Impacted Versions: GitLab EE: all versions from 17.0 before 18.0.5, 18.1 before 18.1.3, and 18.2 before 18.2.1.
CVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

Thanks rogerace for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2025-0765 - Exposure of Sensitive Information to an Unauthorized Actor issue impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed an unauthorized user to access custom service desk email addresses.

Impacted Versions: GitLab CE/EE: all versions from 17.9 before 18.0.5, 18.1 before 18.1.3, and 18.2 before 18.2.1.
CVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

Thanks iamgk808 for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2025-1299 - Improper Access Control issue impacts GitLab CE/EE

GitLab has remediated an issue that, under circumstances, could have allowed an unauthorized user to read deployment job logs by sending a crafted request.

Impacted Versions: GitLab CE/EE affecting all versions starting from 15.4 before 18.0.5, all versions starting from 18.1 before 18.1.3, all versions starting from 18.2 before 18.2.1.
CVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

Thanks pwnie for reporting this vulnerability through our HackerOne bug bounty program.

Bug fixes

18.2.1

• Fix double-path issue for COM_REGISTRY
• Update VERSION files
• Backport of ‘[Agentic Chat] Do not response to NewCheckpoint message’
• Backport of Delete the search_refactor_membership_filter feature flag
• Backport of ‘Fix S3 compatibility in Workhorse uploads for non-AWS S3 providers’
• [Backport] Allow users to resume/continue previous chat sessions in Agentic Chat instead of forcing new chat creation.
• Send workflow metadata for Agentic Chat
• Backport of Fix Github Import E2E
• Backport fix for Workhorse race test: ignore EOF error for Duo Workflow send stream

18.1.3

• Merge branch ‘jk/cache-assets-security-mirror’ into ‘master’
• [backport] ’tbulva-zoekt-url-reset’ into ‘18.1’
• Revert “Merge branch ‘cherry-pick-54ec1758’ into ‘18-1-stable-ee’”
• Merge branch ‘dattang/pass-omnibus-package-to-release-environment-pipeline’ into ‘master’
• Merge branch ‘dattang/run-qa-on-get-release-environment’ into ‘18-1-stable-ee’
• [backport] Add check for allowlist when configuring Elasticsearch URL
• Backport of “Backport of ‘Disable directory_code_dropdown_updates flag’”
• Revert “Enable assets caching on security stable branches”
• Backport of ‘Fixed branches loading on group merge request list’
• Backport of Trigger webhook events on vulnerability dismissal
• Backport GitLab Exporter 15.6.0 to 18.1.x
• Update dependency container-registry to v4.23.2-gitlab

18.0.5

• [Backport 18.0] Zoekt: Only enable global search when nodes are online
• Run GET Release Environments on 18-0-stable-ee
• Backport of ‘Fixed branches loading on group merge request list’
• Backport ‘dattang/fix-syntax-release-env-pipeline’ into ‘18-0-stable-ee’
• [backport to 18.0] Add check for allowlist when configuring Elasticsearch URL
• Backport of Trigger webhook events on vulnerability dismissal
• Update dependency container-registry to v4.21.4-gitlab
• Build Omnibus package for GET Release Environments - 18.0
• Merge branch ‘cb-fix-prein-version-parse’ into ‘18-0-stable’

Updating

To update GitLab, see the Update page. To update Gitlab Runner, see the Updating the Runner page.

Receive Patch Notifications

To receive patch blog notifications delivered to your inbox, visit our contact us page. To receive release notifications via RSS, subscribe to our patch release RSS feed or our RSS feed for all releases.

On July 9, 2025, we released versions 18.1.2, 18.0.4, 17.11.6 for GitLab Community Edition (CE) and Enterprise Edition (EE).

These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action.

GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases: scheduled releases and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays. For more information, please visit our releases handbook and security FAQ. You can see all of GitLab release blog posts here.

For security fixes, the issues detailing each vulnerability are made public on our issue tracker 30 days after the release in which they were patched.

We are committed to ensuring that all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. To maintain good security hygiene, it is highly recommended that all customers upgrade to the latest patch release for their supported version. You can read more best practices in securing your GitLab instance in our blog post.

Recommended Action

We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible.

When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, it means all types are affected.

Security fixes

Table of security fixes

CVE-2025-6948 - Cross-site scripting issue impacts GitLab CE/EE

GitLab has remediated an issue that, under certain conditions, could have allowed a successful attacker to execute actions on behalf of users by injecting malicious content.

Impacted Versions: all versions from 17.11 before 17.11.6, 18.0 before 18.0.4, and 18.1 before 18.1.2.
CVSS: 8.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Thanks yvvdwf for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2025-3396 - Improper authorization issue impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed authenticated project owners to bypass group-level forking restrictions by manipulating API requests.

Impacted Versions: all versions from 13.3 before 17.11.6, 18.0 before 18.0.4, and 18.1 before 18.1.2.
CVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

Thanks theluci for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2025-4972 - Improper authorization issue impacts GitLab EE

GitLab has remediated an issue that could have allowed authenticated users with invitation privileges to bypass group-level user invitation restrictions by manipulating group invitation functionality.

Impacted Versions: all versions from 18.0 before 18.0.4 and 18.1 before 18.1.2.
CVSS: 2.7(CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N)

Thanks mateuszek for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2025-6168 - Improper authorization issue impacts GitLab EE

GitLab has remediated an issue that could have allowed authenticated maintainers to bypass group-level user invitation restrictions by sending crafted API requests.

Impacted Versions: all versions from 18.0 before 18.0.4 and 18.1 before 18.1.2.
CVSS: 2.7 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N)

Thanks hunter0xp7 for reporting this vulnerability through our HackerOne bug bounty program.

rsync security updates

rsync has been updated to version 3.4.1 which contains fixes for security vulnerabilities including CVE-2024-12084 and CVE-2024-12088.

Bug fixes

18.1.2

• Backport Exporter 15.5.0 to 18.1 stable
• update gitlab-org/container-registry to v4.23.2-gitlab
• Merge branch ‘550037-set-static-glab-version-for-release-qa-tests’ into ‘master’
• Quarantine a flaky test
• Fix code owner validation for roles
• Enable using glab for CI release
• Remove Sidekiq shutdown delay in ConcurrencyLimitSampler
• Refactor blob commit info section (18.1 backport)
• Backport ‘Upload cached frontend stable packages’ to 18-1-stable-ee
• [Backport 18.1] Reintroduce body for redirect responses
• Show both author and committer in last commit (18.1 backport)
• Fix creation of PATs using UI on relative installations
• [Backport] Zoekt: Only enable global search when nodes are online
• Fix title on empty projects (18.1 backport)
• Rake Doctor Secrets: Fix WebHook error
• Fix comment typos to trigger asset compilation
• Fix E2E test service_ping_default_enabled_spec.rb
• Fix catalog data loader memoization problem in specs
• Backport “Disable the edit button, instead of not rendering it” to 18.1
• Add a redirect status as a success backport to 18.1
• Make sure to load correct loader on every request
• Merge branch ‘dattang/build-omnibus-for-release-environment’ into ‘18-1-stable-ee’
• Backport ‘dattang/export-release-environment-package-name’ into ‘18-1-stable-ee’
• Quarantine a flaky test
• Backport: ‘revert-grpc-1.72’ into 18-1
• Merge branch ‘jk/cache-assets-for-stable-branch’ into ‘master’
• Fix the owner for sequence ci_builds_id_seq
• Backport GitLab Exporter 15.5.0 to 18.1 stable
• Merge branch ‘dattang/upload-package-for-release-environment’ into ‘18-1-stable’
• Merge branch ‘dattang/build-release-environment-package’ into ‘18-1-stable’
• Merge branch ‘dattang/fix-release-environment-package-name’ into ‘18-1-stable’
• Stable branch builds: Fix versions parsing

18.0.4

• update gitlab-org/container-registry to v4.21.4-gitlab
• Use 1.59.2 version of glab in release_with_glab_spec.rb
• Quarantine a flaky test
• Remove checksum length expectation from the Gitlab::Git::Repository#checksum
• Fix Protected Tags show page
• Fix code owner validation for roles
• Remove Sidekiq shutdown delay in ConcurrencyLimitSampler
• Refactor blob commit info section (18.0 backport)
• Backport ‘Upload cached frontend stable packages’ to 18-0-stable-ee
• [Backport 18.0] Reintroduce body for redirect responses
• Show both author and committer in last commit (18.0 backport)
• Backport “Add a spinner for a loading elipsis menu” to 18.0
• Fix title on empty projects (18.0 backport)
• No-op ValidateCiBuildNeedsProjectIdNotNull
• Fix comment typos to trigger asset compilation
• [Backport 18.0] Fix incorrect redirect when branch doesn’t include files
• Fix creation of PATs using UI on relative installations

17.11.6

• update gitlab-org/container-registry to v4.19.2-gitlab
• Use 1.59.2 version of glab in release_with_glab_spec.rb
• Quarantine a flaky test
• Remove checksum length expectation from the Gitlab::Git::Repository#checksum
• Fix code owner validation for roles
• Revert “Merge branch ‘backport-fix/547265-code-owner-roles-validation-17-11’…
• Backport ‘Upload cached frontend stable packages’ to 17-11-stable-ee
• Fix comment typos to trigger asset compilation
• Backport 1465f38a to 17.11
• Fix incompatible Rails cache version from 7.1 to 6.1
• Fix creation of PATs using UI on relative installations
• [Backport 17.11] Fix incorrect redirect when branch doesn’t include files

Updating

To update GitLab, see the Update page. To update Gitlab Runner, see the Updating the Runner page.

Receive Patch Notifications

To receive patch blog notifications delivered to your inbox, visit our contact us page. To receive release notifications via RSS, subscribe to our patch release RSS feed or our RSS feed for all releases.

On June 25, 2025, we released versions 18.1.1, 18.0.3, 17.11.5 for GitLab Community Edition (CE) and Enterprise Edition (EE).

These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action.

GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases: scheduled releases and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays. For more information, please visit our releases handbook and security FAQ. You can see all of GitLab release blog posts here.

For security fixes, the issues detailing each vulnerability are made public on our issue tracker 30 days after the release in which they were patched.

We are committed to ensuring that all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. To maintain good security hygiene, it is highly recommended that all customers upgrade to the latest patch release for their supported version. You can read more best practices in securing your GitLab instance in our blog post.

Recommended Action

We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible.

When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, it means all types are affected.

Security fixes

Table of security fixes

CVE-2025-3279 - Denial of Service impacts GitLab CE/EE

GitLab has remediated an issue that, under certain conditions, could have allowed authenticated attackers to create a DoS condition by sending crafted GraphQL requests.

Impacted Versions: GitLab CE/EE: all versions from 10.7 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1.
CVSS: 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Thanks pwnie for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2025-1754 - Missing Authentication issue impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed unauthenticated attackers to upload arbitrary files to public projects by sending crafted API requests, potentially leading to resource abuse and unauthorized content storage.

Impacted Versions: GitLab CE/EE: all versions from 17.2 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1.
CVSS: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

Thanks abdelrahman_maged for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2025-5315 - Improper access control issue impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed authenticated users with Guest role permissions to add child items to incident work items by sending crafted API requests that bypassed UI-enforced role restrictions.

Impacted Versions: GitLab CE/EE: all versions from 17.2 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1.
CVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)

Thanks rhidayahh for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2025-2938 - Elevation of Privilege impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed authenticated users to gain elevated project privileges by requesting access to projects where role modifications during the approval process resulted in unintended permission grants.

Impacted Versions: GitLab CE/EE: all versions from 17.3 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1.
CVSS: 3.1 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N)

Thanks mateuszek for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2025-5846 - Improper access control issue impacts GitLab EE

GitLab has remediated an issue that could have allowed authenticated users to assign unrelated compliance frameworks to projects by sending crafted GraphQL mutations that bypassed framework-specific permission checks.

Impacted Versions: GitLab EE: all versions from 16.10 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1
CVSS: 2.7 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N)

This vulnerability was reported internally by a GitLab team member, Joern Schneeweisz.

Bug fixes

18.1.1

• (Backport to 18.1) fix: Don’t unset IMAGE_TAG_EXT passed by gitlab-org/gitlab
• Backport: Drop ubi-assets-release CI job
• [backport] 18.1: Merge branch ‘dj-exclude-stable-branch-coverage’ into ‘master’
• fix: Backport fix on git over ssh
• Check if Amazon Q should be enabled at project level

18.0.3

• [backport] Fix line number in zoekt response
• Restrict LFS file download to project-bound objects
• Backport “E2E test: account for Duo Core behaviour in code suggestion tests”
• Backport “E2E test: disable elasticsearch omnibus jobs”
• Backport “Fix Self Hosted Duo Beta features not being available” to 18.0
• Backport ‘Move up release-environments stage in CI’ to 18-0-stable-ee
• Projects::TransferService should be more reliable
• Merge branch ‘jmc-549650’ into ‘master’
• backport ’tbulva-zoekt-flashing-no-results’ into 18.0
• Merge branch ’tbulva-search-page-scope-fix’ into ‘master’
• Backport attribute_methods.rb
• Backport “Fix losing wiki comments on some wiki page slug changes”
• Backport to 18.0: Set glab version for release QA tests
• Backport vulnerability_namespace_historical_statistic fix to 18.0
• [backport] 18.0: Merge branch ‘dj-exclude-stable-branch-coverage’ into ‘master’
• Support markdown anchors and multi-line in permalink
• fix: Backport fix on git over ssh
• Backport flaky logger test fix
• Revert “Merge branch ‘backport-bugfix-restrict-LFS-download–18-0’ into ‘18-0-stable-ee’”
• Merge branch ‘dattang/build-internal-release-qa-image’ into ‘18-0-stable-ee’

17.11.5

• Merge branch ‘350883-update-to-use-live-trace-application-setting’ into ‘17-11-stable’
• Restrict LFS file download to project-bound objects
• Backport ‘Move up release-environments stage in CI’ to 17-11-stable-ee
• Merge branch ‘jmc-549650’ into ‘17-11-stable-ee’
• Backport ‘Update Import::ValidateRemoteGitEndpoint Service’
• Backport to 17.11: Set glab version for release QA tests
• Backport vulnerability_namespace_historical_statistic fix to 17.11
• [backport] 17.11: Merge branch ‘dj-exclude-stable-branch-coverage’ into ‘master’
• fix: Backport fix on git over ssh
• Revert “Merge branch ‘backport-bugfix-restrict-LFS-download–17-11’ into ‘17-11-stable-ee’”
• Merge branch ‘dattang/build-internal-release-qa-image’ into ‘master’
• [Backport - 17.11.x] Removing postponed deprecation from omnibus

Updating

To update GitLab, see the Update page. To update GitLab Runner, see the Updating the Runner page.

Receive Patch Notifications

To receive patch blog notifications delivered to your inbox, visit our contact us page. To receive release notifications via RSS, subscribe to our patch release RSS feed or our RSS feed for all releases.

On June 11, 2025, we released versions 18.0.2, 17.11.4, 17.10.8 for GitLab Community Edition (CE) and Enterprise Edition (EE).

These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action.

GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases: scheduled releases and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays. For more information, please visit our releases handbook page and security FAQ. You can see all of GitLab’s release blog posts here.

For security fixes, the issues detailing each vulnerability are made public on our issue tracker 30 days after the release in which they were patched.

We are committed to ensuring that all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. To maintain good security hygiene, it is highly recommended that all customers upgrade to the latest patch release for their supported version. You can read more best practices in securing your GitLab instance in our blog post.

Recommended Action

We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible.

When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, it means all types are affected.

Security fixes

Table of security fixes

CVE-2025-4278 - HTML injection impacts GitLab CE/EE

GitLab has remediated an issue that, under certain conditions, could have allowed a successful attacker to achieve account takeover by injecting code into the search page. Impacted versions GitLab CE/EE: all versions starting with 18.0 before 18.0.2. CVSS: 8.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N)

Thanks joaxcar for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2025-2254 - Cross-site scripting issue impacts GitLab CE/EE

GitLab has remediated an issue that, under certain conditions, could have allowed a successful attacker to act in the context of a legitimate user by injecting a malicious script into the snippet viewer.
Impacted versions GitLab CE/EE: all versions from 17.9 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2
CVSS 8.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N)

Thanks yvvdwf for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2025-5121 - Missing authorization issue impacts GitLab Ultimate EE

GitLab has remediated an issue that, under certain conditions, could have allowed a successful attacker with authenticated access to a GitLab instance with a GitLab Ultimate license applied (paid customer or trial) to inject a malicious CI/CD job into all future CI/CD pipelines of any project.
Impacted versions GitLab Ultimate EE from 17.11 before 17.11.4 and 18.0 before 18.0.2. CVSS 8.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H)

Thanks jean_d-ou for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2025-0673 - Denial of Service impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed a successful attacker to deny access to legitimate users of the targeted system by triggering an infinite redirect loop causing memory exhaustion on the server.

Impacted versions GitLab CE/EE: all versions from 17.7 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2
CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Thanks sim4n6 for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2025-1516 - Denial of Service via unbounded Webhook token names impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed a successful attacker to deny access to legitimate users of the targeted system by generating tokens with sufficiently large names. Impacted versions GitLab CE/EE: all versions from 8.7 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2
CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Thanks pwnie for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2025-1478 - Denial of Service via unbounded Board Names impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed a successful attacker to deny access to legitimate users of the targeted system by crafting Board Names with sufficiently large sizes.
Impacted versions GitLab CE/EE: all versions from 8.13 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1
CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Thanks pwnie for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2024-9512 - Information disclosure issue impacts GitLab CE/EE

GitLab has remediated an issue that, under certain conditions, could have allowed a successful attacker to clone a legitimate user’s private repository by sending a timed clone request when a secondary node is out of sync.

Impacted versions GitLab CE/EE: all versions prior to 17.10.8, 17.11 prior to 17.11.4, and 18.0 prior to 18.0.2
CVSS 5.3 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N)

Thanks hdtran for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2025-5996 - Denial of Service (DoS) via uncontrolled HTTP Response Processing impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed a successful attacker to deny access to legitimate users of the targeted system by integrating a malicious third-party component into a GitLab project.
Impacted versions GitLab CE/EE: versions from 2.1.0 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2
CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Thanks joaxcar and pwnie for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2025-5195 - Information disclosure via authorization bypass impacts GitLab CE/EE

GitLab has remediated an issue that could have allowed authenticated users to gain access to data beyond their privilege boundaries by accessing arbitrary compliance frameworks. Impacted versions GitLab CE/EE: all versions from 17.9 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1
CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

This vulnerability has been discovered internally by a member of the GitLab team.

CVE-2025-5982 - Sensitive information disclosure via Group IP restriction bypass

GitLab has remediated an issue that could have allowed a successful attacker to bypass IP access restrictions and view sensitive group information. Impacted versions GitLab EE: versions from 12.0 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2.
CVSS 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)

This vulnerability has been discovered internally by GitLab team member @joernchen.

Bug fixes

18.0.2

• Move fork_networks organization_id NOT NULL to post-migrate
• [Backport] Zoekt: Only enable search when nodes are online
• 18-0-stable-ee: Trim pages deployment file name to 60 characters
• Fix gitpod button is missing in the edit dropdown
• [Backport] Elastic::MigrationWorker should not create migrations index
• Backport operational data_category for duo_core_features_enabled metric on service ping
• [Backport] Fix IDE links returns about:blank in old code dropdow
• Fix the title/body issue for todo apis when it is a duo todo
• Add 18.0 “What’s New” entries
• [Backport] mark_all_as_completed! method should drop halted cache & save halted: false
• Fix “No such column: geo_nodes.verification_max_capacity”
• [backport] 18.0: Merge branch ‘dj-stable-branch-dont-fail-e2e’ into ‘master’
• [backport] 18.0: Merge branch ‘dj-refactor-semgrep-ci’ into ‘master’
• [backport] 18.0: Remove e2e:test-on-omnibus-ee from tier 1 backport MRs
• Fix libarchive checksum script (Backport 18.0)
• Warn on changes to tag only CI job definitions
• Backport postponing deprecation to 19.0

17.11.4

• [backport] 17.11: Remove jest vue3 check quarantine jobs from backport MR pipelines
• 17-11-stable-ee: Trim pages deployment file name to 60 characters
• Fix gitpod button is missing in the edit dropdown
• [backport] 17.11: Merge branch ‘dj-stable-branch-dont-fail-e2e’ into ‘master’
• Merge ‘535187-fix-console-errors’ into ‘17-11-stable-ee’
• Attempt to migrate ci_runner_taggings table (try 2)
• [backport] 17.11: Remove e2e:test-on-omnibus-ee from tier 1 backport MRs
• [backport] 17.11: Merge branch ‘dj-refactor-semgrep-ci’ into ‘master’
• Fix libarchive checksum script (Backport 17.11)

17.10.8

• [backport] 17.10: Remove jest vue3 check quarantine jobs from backport MR pipelines
• Fix gitpod button is missing in the edit dropdown
• [backport] 17.10: Merge branch ‘dj-stable-branch-dont-fail-e2e’ into ‘master’
• Attempt to migrate ci_runner_taggings table (try 2)
• [backport] 17.10: Merge branch ‘dj-refactor-semgrep-ci’ into ‘master’
• [backport] 17.10: Remove e2e:test-on-omnibus-ee from tier 1 backport MRs
• Fix libarchive checksum script (Backport 17.10)

Updating

To update GitLab, see the Update page. To update Gitlab Runner, see the Updating the Runner page.

Receive Patch Notifications

To receive patch blog notifications delivered to your inbox, visit our contact us page. To receive release notifications via RSS, subscribe to our patch release RSS feed or our RSS feed for all releases.

On May 21, 2025, we released versions 18.0.1, 17.11.3, 17.10.7 for GitLab Community Edition (CE) and Enterprise Edition (EE).

These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action.

GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases: scheduled releases, and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays. For more information, you can visit our releases handbook and security FAQ. You can see all of GitLab release blog posts here.

For security fixes, the issues detailing each vulnerability are made public on our issue tracker 30 days after the release in which they were patched.

We are committed to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers upgrade to the latest patch release for their supported version. You can read more best practices in securing your GitLab instance in our blog post.

Recommended Action

We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible.

When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.

Security fixes

Table of security fixes

Unprotected large blob endpoint in GitLab allows Denial of Service

An issue has been discovered in GitLab CE/EE affecting all versions before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. This could allow an authenticated attacker to cause a denial of service condition by exhausting server resources. This is a high severity issue (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5). It is now mitigated in the latest release and is assigned CVE-2025-0993.

Thanks pwnie for reporting this vulnerability through our HackerOne bug bounty program.

Improper XPath validation allows modified SAML response to bypass 2FA requirement

An issue has been discovered in GitLab CE/EE affecting all versions from 11.1 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. Improper XPath validation allowed modified SAML responses to bypass 2FA requirement under specialized conditions. This is a medium severity issue (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N, 6.8). It is now mitigated in the latest release and is assigned CVE-2024-12093.

Thanks joaxcar for reporting this vulnerability through our HackerOne bug bounty program.

A Discord webhook integration may cause DoS

An issue has been discovered in GitLab CE/EE affecting all versions from 11.6 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. A Discord webhook integration may cause DoS. This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 6.5). It is now mitigated in the latest release and is assigned CVE-2024-7803.

Thanks a92847865 for reporting this vulnerability through our HackerOne bug bounty program.

Unbounded Kubernetes cluster tokens may lead to DoS

An issue has been discovered in GitLab CE/EE affecting all versions from 10.2 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. A lack of input validation in the Kubernetes integration could allow an authenticated user to cause denial of service. This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 6.5). It is now mitigated in the latest release and is assigned CVE-2025-3111.

Thanks pwnie for reporting this vulnerability through our HackerOne bug bounty program.

Unvalidated notes position may lead to Denial of Service

An issue has been discovered in GitLab CE/EE affecting all versions before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. A lack of proper validation in GitLab could allow an authenticated user to cause a denial of service condition. This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 6.5). It is now mitigated in the latest release and is assigned CVE-2025-2853.

Thanks pwnie for reporting this vulnerability through our HackerOne bug bounty program.

Hidden/masked variables may get exposed in the UI

An issue has been discovered in GitLab CE/EE affecting all versions before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. An attacker may be able to reveal masked or hidden CI variables (that they did not author) in the WebUI, by simply creating their own variable and observing the HTTP response. This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, 4.9). It is now mitigated in the latest release and is assigned CVE-2025-4979.

Thanks mateuszek for reporting this vulnerability through our HackerOne bug bounty program.

Two-factor authentication requirement bypass

An issue has been discovered in GitLab CE/EE affecting all versions from 16.8 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. Group access controls could allow certain users to bypass two-factor authentication requirements. This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N, 4.6). It is now mitigated in the latest release and is assigned CVE-2025-0605.

Thanks salh4ckr for reporting this vulnerability through our HackerOne bug bounty program.

View full email addresses that should be partially obscured

An issue has been discovered in GitLab CE/EE affecting all versions from 17.1 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. Under certain conditions un-authorised users can view full email addresses that should be partially obscured. This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, 4.3). It is now mitigated in the latest release and is assigned CVE-2025-0679.

Thanks mateuszek for reporting this vulnerability through our HackerOne bug bounty program.

Branch name confusion in confidential MRs

A business logic error in GitLab CE/EE affecting all versions starting from 12.1 prior to 17.10.7, 17.11 prior to 17.11.3 and 18.0 prior to 18.0.1 where an attacker can cause a branch name confusion in confidential MRs. This is a low severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N, 3.5). It is now mitigated in the latest release and is assigned CVE-2024-9163.

Thanks foxribeye for reporting this vulnerability through our HackerOne bug bounty program.

Unauthorized access to job data via a GraphQL query

An issue has been discovered in GitLab CE/EE affecting all versions from 18.0 before 18.0.1. In certain circumstances, a user with limited permissions could access Job Data via a crafted GraphQL query. This is a low severity issue (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N, 2.7). It is now mitigated in the latest release and is assigned CVE-2025-1110.

Thanks pwnie for reporting this vulnerability through our HackerOne bug bounty program.

Mattermost Security Updates April 29, 2025

Mattermost has been updated to apply the latest patches for low and medium level security issues.

Bug fixes

18.0.1

• Fix CI_COMMIT_REF tags of FIPS build images
• Bump gitlab-shell to v14.42.0 - 18.0 backport
• [Backport] Do not run index integrity worker for zoekt search
• Update gitlab-qa to 15.5.0
• Add outbound allowlist to allowed endpoints for SSRF filter
• Apply Rails 7-1-stable patches to fix type map init issues
• KAS: remove unsupported GitOps config (18.0 backport)

17.11.3

• Backport 17.11: Generate separate project and group work items fixtures
• [BACKPORT] Fix flaky specs in Import::GitHubService
• [backport] Fixed command palette edge case
• Delete BBM backfill_project_id_for_projects_with_pipeline_variables backport to 17.11
• Add backport to fix shortSHA uniqueness
• [backport] 17.11: Enable FF_TIMESTAMPS for stable branch pipelines
• [backport] Add a ping? check before hitting Elasticsearch in admin
• [Backport]Autocomplete: Change user authorization to use terms query for projects
• Bump gitlab-shell to v14.42.0
• Respect product usage data setting from charts
• Merge branch ’tbulva-zoekt-global-search-bug’ into ‘master’
• Add outbound allowlist to allowed endpoints for SSRF filter
• Drop ci_runner_machines_archived table
• 17.11: Use no_longer_detected_ids when auto-resolving vulnerabilities
• Update outdated test certificates [17.11]
• Revert “Merge branch ‘renovate/pgbouncer-pgbouncer-1.x’ into ‘master’”
• Ensure correct version of Nginx modules gets included in the package

17.10.7

• Backport 17.10: Generate separate project and group work items fixtures
• [BACKPORT] Fix flaky specs in Import::GitHubService
• [backport] 17.10: Enable FF_TIMESTAMPS for stable branch pipelines
• Bump gitlab-shell to v14.42.0
• Drop ci_runner_machines_archived table
• Update outdated test certificates [17.10]
• Ensure correct version of Nginx modules gets included in the package

Updating

To update GitLab, see the Update page. To update Gitlab Runner, see the Updating the Runner page.

Receive Patch Notifications

To receive patch blog notifications delivered to your inbox, visit our contact us page. To receive release notifications via RSS, subscribe to our patch release RSS feed or our RSS feed for all releases.

On May 7, 2025, we released versions 17.11.2, 17.10.6, 17.9.8 for GitLab Community Edition (CE) and Enterprise Edition (EE).

These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action.

GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases: scheduled releases, and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays. For more information, you can visit our releases handbook and security FAQ. You can see all of GitLab release blog posts here.

For security fixes, the issues detailing each vulnerability are made public on our issue tracker 30 days after the release in which they were patched.

We are committed to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers upgrade to the latest patch release for their supported version. You can read more best practices in securing your GitLab instance in our blog post.

Recommended Action

We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible.

When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.

Security fixes

Table of security fixes

Partial Bypass for Device OAuth flow using Cross Window Forgery

An issue has been discovered in GitLab CE/EE affecting all versions starting from 17.3 prior to 17.9.8, from 17.10 prior to 17.10.6, and from 17.11 prior to 17.11.2. Under certain conditions Device OAuth flow protections could be bypassed, enabling authorization form submission through minimal user interaction. This is a medium severity issue (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N, 6.8). It is now mitigated in the latest release and is assigned CVE-2025-0549.

Thanks sim4n6 for reporting this vulnerability through our HackerOne bug bounty program.

Denial of service by abusing Github import API

An issue has been discovered in GitLab CE/EE affecting all versions starting from 17.1 prior to 17.9.8, from 17.10 prior to 17.10.6, and from 17.11 prior to 17.11.2. It was possible to cause a DoS condition via GitHub import requests using a malicious crafted payload. This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 6.5). It is now mitigated in the latest release and is assigned CVE-2024-8973.

Thanks a92847865 for reporting this vulnerability through our HackerOne bug bounty program.

Group IP restriction bypass allows disclosing issue title of restricted project

An issue has been discovered in GitLab CE/EE affecting all versions from 12.0 before 17.9.8, 17.10 before 17.10.6, and 17.11 before 17.11.2. Under certain conditions users could bypass IP access restrictions of a group, enabling them to disclose sensitive information. This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, 5.3). It is now mitigated in the latest release and is assigned CVE-2025-1278.

Thanks iamgk808 for reporting this vulnerability through our HackerOne bug bounty program.

Bug fixes

17.11.2

• Merge branch ‘renovate-e2e/gitlab-qa-15.x’ into ‘17-11-stable-ee’
• [backport] Fix subgroup search redirect if SAML auth expired
• Fix MR diffs endpoint to respond with pagination headers
• Fix token prefix change when PAT prefix is nil
• [backport] Respect fork filter for global zoekt search
• [17.11] Bump graphql gem to 2.4.13
• [Backport] Allow SSO enforcer to skip root owner check
• [17.11] Only check records with encrypted data in gitlab:doctor:encryption_keys
• Change to async_delete for ci_running_builds.runner_id
• Merge branch ‘pb-fix-matrix-use-case’ into ‘master’
• Update gitlab-development-kit digest to 59037d8
• Backport (17.11): Bump Devfile gem to 0.4.3
• Backport (17.11): Ensure all LFK’s are processed regardless of duration
• [17.11 Backport] Change the travel date for analytics/dashboards_spec.rb
• config/git: Fix misdetected shell path (17.11 backport)

17.10.6

• [17.10] Bump graphql gem to 2.4.13
• [17.10] Only check records with encrypted data in gitlab:doctor:encryption_keys
• Change to async_delete for ci_running_builds.runner_id
• Update gitlab-development-kit digest to 59037d8
• Backport (17.10): Bump Devfile gem to 0.4.3
• Cherry pick ‘8995-json-parse-utf8’ into ‘17-10-stable’

17.9.8

• [17.9] Bump graphql gem to 2.4.13
• [17.9] Only check records with encrypted data in gitlab:doctor:encryption_keys
• Update gitlab-development-kit digest to 59037d8
• Backport (17.9): Bump devfile gem to v0.4.3

Updating

To update GitLab, see the Update page. To update Gitlab Runner, see the Updating the Runner page.

Receive Patch Notifications

To receive patch blog notifications delivered to your inbox, visit our contact us page. To receive release notifications via RSS, subscribe to our patch release RSS feed or our RSS feed for all releases.

On April 23, 2025, we released versions 17.11.1, 17.10.5, 17.9.7 for GitLab Community Edition (CE) and Enterprise Edition (EE).

These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action.

GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases: scheduled releases, and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays. For more information, you can visit our releases handbook and security FAQ. You can see all of GitLab release blog posts here.

For security fixes, the issues detailing each vulnerability are made public on our issue tracker 30 days after the release in which they were patched.

We are committed to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers upgrade to the latest patch release for their supported version. You can read more best practices in securing your GitLab instance in our blog post.

Recommended Action

We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible.

When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.

Security fixes

Table of security fixes

Cross Site Scripting (XSS) in Maven Dependency Proxy through CSP directives

An issue has been discovered in GitLab EE that allows for cross-site-scripting attack and content security policy bypass in a user’s browser under specific conditions, affecting all versions from 16.6 prior to 17.9.7, 17.10 prior to 17.10.5, and 17.11 prior to 17.11.1. This is a high severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N, 8.7). It is now mitigated in the latest release and is assigned CVE-2025-1763.

Thanks joaxcar for reporting this vulnerability through our HackerOne bug bounty program.

Cross Site Scripting (XSS) in Maven dependency proxy through cache headers

An issue has been discovered in GitLab EE that allows for cross-site-scripting attack and content security policy bypass in a user’s browser under specific conditions, affecting all versions from 16.6 prior to 17.9.7, 17.10 prior to 17.10.5, and 17.11 prior to 17.11.1. This is a high severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N, 8.7). It is now mitigated in the latest release and is assigned CVE-2025-2443.

Thanks joaxcar for reporting this vulnerability through our HackerOne bug bounty program.

Network Error Logging (NEL) Header Injection in Maven Dependency Proxy Allows Browser Activity Monitoring

An issue has been discovered in GitLab EE/CE that could allow an attacker to track users’ browsing activities, potentially leading to full account take-over, affecting all versions from 16.6 prior to 17.9.7, 17.10 prior to 17.10.5, and 17.11 prior to 17.11.1. This is a high severity issue (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N, 7.7). It is now mitigated in the latest release and is assigned CVE-2025-1908.

Thanks joaxcar for reporting this vulnerability through our HackerOne bug bounty program.

Denial of service (DOS) via issue preview.

An issue has been discovered affecting service availability via issue preview in GitLab CE/EE affecting all versions from 16.7 prior to 17.9.7, 17.10 prior to 17.10.5, and 17.11 prior to 17.11.1. This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 6.5). It is now mitigated in the latest release and is assigned CVE-2025-0639.

Thanks sigitsetiawansss for reporting this vulnerability through our HackerOne bug bounty program.

Unauthorized access to branch names when Repository assets are disabled in the project

An issue has been discovered in access controls that could allow users to view certain restricted project information even when related features are disabled in GitLab EE, affecting all versions from 17.7 prior to 17.9.7, 17.10 prior to 17.10.5, and 17.11 prior to 17.11.1. This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, 4.3). It is now mitigated in the latest release and is assigned CVE-2024-12244.

Thanks mateuszek for reporting this vulnerability through our HackerOne bug bounty program.

Bug fixes

17.11.1

• Put allow_composite_identities_to_run_pipelines behind ff
• Backporting doc fix for Amazon Q
• [BP]last_rollout_failed_at should be set for failures namespaces also
• Fix Amazon Q disconnect for already destroyed app
• Fix string conversion for CI Inputs
• Backport fix for latest DS template in combination with Static Reachability
• Merge branch ‘535633-new-look-causes-attach-file-to-ignore-external_url’ into ‘master’
• Patch in 17.11: Sync Cloud Connector tokens hourly
• Update Workhorse Gitaly client dependency

17.10.5

• Backport ‘fix-ubi-mailroom-location’ into ‘17-10-stable’
• backport update-go-grpc-to-1.71.1 to 17-10-stable
• [Backport 17.10] Bulk indexing cron workers should respect pause setting
• [17.10] Backport: Zoekt: Fix incorrect project filtering in Zoekt initial indexing
• Backport: Zoekt: Rollout is considering offline nodes as well
• Backport: Zoekt Newly created indices are instantly evicted
• Backport NoMethodError: zoekt_nodes is null in some instances
• Fix workspaces reconciliation to send inventory config map correctly
• [17.10 Backport] Clean up the FinalizeBackfillCiRunnerMachinesPartitionedTable migration
• Introduce a new gitlab:doctor:encryption_keys task
• Backport “Resolve “/api/v4/todos returns 500 when has wiki todo””
• Update workhorse gitalyclient dependency update backport to 17.10
• [17.10 Backport] Clear session cookie when browser is closed
• Backport AI events backfill from PG to ClickHouse
• Patch in 17.10: Sync Cloud Connector tokens hourly

17.9.7

• Backport setting FIPS and UBI pipeline name to 17-9-stable
• Backport ‘fix-ubi-mailroom-location’ into ‘17-9-stable’
• backport update-go-grpc-to-1.71.1 to 17-9-stable
• [17.9 Backport] Clean up the FinalizeBackfillCiRunnerMachinesPartitionedTable migration
• Introduce a new gitlab:doctor:encryption_keys task
• Update workhorse gitalyclient dependency backport to 17.9

Updating

To update GitLab, see the Update page. To update Gitlab Runner, see the Updating the Runner page.

Receive Patch Notifications

To receive patch blog notifications delivered to your inbox, visit our contact us page. To receive release notifications via RSS, subscribe to our patch release RSS feed or our RSS feed for all releases.

On April 9, 2025, we released versions 17.10.4, 17.9.6, 17.8.7 for GitLab Community Edition (CE) and Enterprise Edition (EE).

These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action.

GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases: scheduled releases, and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays. For more information, you can visit our releases handbook and security FAQ. You can see all of GitLab release blog posts here.

For security fixes, the issues detailing each vulnerability are made public on our issue tracker 30 days after the release in which they were patched.

We are committed to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers upgrade to the latest patch release for their supported version. You can read more best practices in securing your GitLab instance in our blog post.

Recommended Action

We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible.

When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.

Security fixes

Table of security fixes

Denial of service via CI pipelines

A Denial of Service (DoS) issue has been discovered in GitLab CE/EE affecting all up to 17.8.7, 17.9 prior to 17.9.6 and 17.10 prior to 17.10.4. A denial of service could occur upon injecting oversized payloads into CI pipeline exports. This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 6.5). It is now mitigated in the latest release and is assigned CVE-2025-1677.

Thanks pwnie for reporting this vulnerability through our HackerOne bug bounty program.

Unintentionally authorizing sensitive actions on users behalf

An issue has been discovered in GitLab CE/EE affecting all versions from 7.7 before 17.8.7, 17.9 before 17.9.6, and 17.10 before 17.10.4. Under certain conditions, an attacker could potentially trick users into unintentionally authorizing sensitive actions on their behalf. This is a medium severity issue (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N, 6.4). It is now mitigated in the latest release and is assigned CVE-2025-0362.

Thanks joaxcar for reporting this vulnerability through our HackerOne bug bounty program.

IP Restriction Bypass through GraphQL Subscription

An issue has been discovered in GitLab CE/EE affecting all versions from 13.12 before 17.8.7, 17.9 before 17.9.6, and 17.10 before 17.10.4. Under certain conditions users could bypass IP access restrictions and view sensitive information. This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, 5.3). It is now mitigated in the latest release and is assigned CVE-2025-2408.

Thanks rogerace for reporting this vulnerability through our HackerOne bug bounty program.

Unauthorized users can list the number of confidential issues

An issue has been discovered in GitLab EE affecting all versions from 17.1 before 17.8.7, 17.9 before 17.9.6, and 17.10 before 17.10.4, This allows attackers to perform targeted searches with sensitive keywords to get the count of issues containing the searched term. This is a medium severity issue (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N, 5.3). It is now mitigated in the latest release and is assigned CVE-2024-11129

Thanks a92847865 for reporting this vulnerability through our HackerOne bug bounty program

Debugging Information Disclosed

An issue has been discovered in GitLab CE/EE affecting all versions from 17.9 before 17.9.6, and 17.10 before 17.10.4. The runtime profiling data of a specific service was accessible to unauthenticated users. This is a low severity issue (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N, 3.7). It is now mitigated in the latest release and is assigned CVE-2025-2469.

Thanks ap-wtioit for reporting this vulnerability through our HackerOne bug bounty program.

Bug fixes

17.10.4

• Cherry-picks multiple fixes into 17.10
• Fix invalid pipelines for scan execution policies
• Move group.cluster_agents field to CE
• Fixes merge requests updating URL with reports project
• Update approval rules name validation to include approval policy
• Workhorse golang-jwt/jwt upgrade to 5.2.2
• Golang Oauth2 upgrade to 0.27.0

17.9.6

• Workhorse golang-jwt/jwt upgrade to 5.2.2

17.8.7

• CI: Use gcr mirror in DinD (17.8 Backport)
• No-op ci_runner_machines_687967fa8a batched migrations - 17.8 backport
• Cherry-picks bug fixes into 17.8
• Backport fix in libarchive for CI
• CI: Use gcr mirror for DinD (17.8 Backport)
• [17.8 Backport] Check packages does not have .dind job in scope
• CI: Optionally enable dependency proxy (Backport 17.8)
• Workhorse golang-jwt/jwt upgrade to 5.2.2

Updating

To update GitLab, see the Update page. To update Gitlab Runner, see the Updating the Runner page.

Receive Patch Notifications

To receive patch blog notifications delivered to your inbox, visit our contact us page. To receive release notifications via RSS, subscribe to our patch release RSS feed or our RSS feed for all releases.

On April 2, 2025, we released versions 17.10.3 for GitLab Community Edition and Enterprise Edition.

These versions resolve a number of regressions and bugs. This patch release does not include any security fixes.

GitLab Community Edition and Enterprise Edition

17.10.3

• CI: Use gcr mirror in DinD (17.10 Backport)
• No-op ci_runner_machines_687967fa8a batched migrations - 17.10 backport
• Ensure runner taggings are copied from taggings
• Fix free push limit on non-saas
• Backport fix in libarchive for CI
• CI: Use gcr mirror for DinD (17.10 Backport)
• [17.10 Backport] Check packages does not have .dind job in scope

Important notes on upgrading

This version includes new post deployment migrations, and for multi-node deployments, should not require any downtime.

Please be aware that by default the Omnibus packages will stop, run migrations, and start again, no matter how “big” or “small” the upgrade is. This behavior can be changed by adding a /etc/gitlab/skip-auto-reconfigure file, which is only used for updates.

Updating

To update, check out our update page.

Note: GitLab releases have skipped 17.10.2. There is no patch with that version number.

GitLab subscriptions

Access to GitLab Premium and Ultimate features is granted by a paid subscription.

Alternatively, sign up for GitLab.com to use GitLab’s own infrastructure.

On April 2, 2025, we released versions 17.9.5 for GitLab Community Edition and Enterprise Edition.

These versions resolve a number of regressions and bugs. This patch release does not include any security fixes.

GitLab Community Edition and Enterprise Edition

17.9.5

• CI: Use gcr mirror in DinD (17.9 Backport)
• No-op ci_runner_machines_687967fa8a batched migrations - 17.9 backport
• Ensure runner taggings are copied from taggings
• Backport fix in libarchive for CI
• CI: Use gcr mirror for DinD (17.9 Backport)

Important notes on upgrading

This version includes new post deployment migrations, and for multi-node deployments, should not require any downtime.

Please be aware that by default the Omnibus packages will stop, run migrations, and start again, no matter how “big” or “small” the upgrade is. This behavior can be changed by adding a /etc/gitlab/skip-auto-reconfigure file, which is only used for updates.

Updating

To update, check out our update page.

Note: GitLab releases have skipped 17.9.4. There is no patch with that version number.

GitLab subscriptions

Access to GitLab Premium and Ultimate features is granted by a paid subscription.

Alternatively, sign up for GitLab.com to use GitLab’s own infrastructure.

On March 26, 2025, we released versions 17.10.1, 17.9.3, 17.8.6 for GitLab Community Edition (CE) and Enterprise Edition (EE).

These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action.

GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases: scheduled releases, and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays. For more information, you can visit our releases handbook and security FAQ. You can see all of GitLab release blog posts here.

For security fixes, the issues detailing each vulnerability are made public on our issue tracker 30 days after the release in which they were patched.

We are committed to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers upgrade to the latest patch release for their supported version. You can read more best practices in securing your GitLab instance in our blog post.

Recommended Action

We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible.

When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.

Security fixes

Table of security fixes

Cross-site Scripting (XSS) through merge-request error messages

An issue has been discovered in Gitlab EE/CE affecting all versions from 13.5.0 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1. Certain error messages could allow Cross-Site Scripting attacks (XSS). This is a high severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N, 8.7). It is now mitigated in the latest release and is assigned CVE-2025-2255.

Thanks yvvdwf for reporting this vulnerability through our HackerOne bug bounty program.

Cross-site Scripting (XSS) through improper rendering of certain file types

An issue has been discovered in GitLab CE/EE affecting all versions from 17.7 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1. Improper rendering of certain file types leads to cross-site scripting. This is a high severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N, 8.7). It is now mitigated in the latest release and is assigned CVE-2025-0811.

Thanks yvvdwf for reporting this vulnerability through our HackerOne bug bounty program.

Admin Privileges Persists After Role is Revoked

An improper access control vulnerability in GitLab CE/EE affecting all versions from 17.4 prior to 17.8.6, 17.9 prior to 17.9.3, and 17.10 prior to 17.10.1 allows a user who was an instance admin before but has since been downgraded to a regular user to continue to maintain elevated privileges to groups and projects. This is a high severity issue (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.5). It is now mitigated in the latest release and is assigned CVE-2025-2242.

External user can access internal projects

An issue has been discovered in GitLab CE/EE affecting all versions from 16.0 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1, allowing internal users to gain unauthorized access to internal projects. This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N, 5.2). It is now mitigated in the latest release and is assigned CVE-2024-12619.

Thanks aituglo for reporting this vulnerability through our HackerOne bug bounty program.

Prompt injection in Amazon Q integration may allow unauthorized actions

An issue has been discovered in the GitLab Duo with Amazon Q affecting all versions from 17.8 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1. A specifically crafted issue could manipulate AI-assisted development features to potentially expose sensitive project data to unauthorized users. This is a medium severity issue (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N, 4.4). We have requested a CVE ID and will update this blog post when it is assigned.

This vulnerability has been discovered internally by GitLab team member Félix Veillette-Potvin.

Uncontrolled Resource Consumption via a maliciously crafted terraform file in merge request

An issue has been discovered in GitLab EE/CE affecting all versions from 12.10 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1. A maliciously crafted file can cause uncontrolled CPU consumption when viewing the associated merge request. This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L, 4.3). It is now mitigated in the latest release and is assigned CVE-2024-10307.

Thanks l33thaxor for reporting this vulnerability through our HackerOne bug bounty program.

Maintainer can inject shell code in Harbor project name configuration when using helper scripts

An issue was discovered in GitLab EE affecting all versions starting from 14.9 before 17.8.6, all versions starting from 17.9 before 17.9.3, all versions starting from 17.10 before 17.10.1. An input validation issue in the Harbor registry integration could have allowed a maintainer to add malicious code to the CLI commands shown in the UI. This is a low severity issue (CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N, 3.7). It is now mitigated in the latest release and is assigned CVE-2024-9773.

Thanks joaxcar for reporting this vulnerability through our HackerOne bug bounty program.

Bug fixes

17.10.1

• Merge branch ‘fixup-non-based-ubi’ into ‘17-10-stable’
• Changes for storing value of bypass_two_factor to session
• Correct incorrect PG version in CHANGELOG

17.9.3

• Bump go to v1.23.6
• Merge branch ‘fixup-non-based-ubi’ into ‘17-9-stable’
• 17.9 Backport: jliu/gitaly-dns-tls
• 17.9 backport: Update build-proto-gem
• [Backport 17.9] Fix frozen array error with custom analyzers
• Update dependency gitlab-mail_room to v0.0.27
• [backport] Fixed regex and syntax options button under some conditions
• [17.9] Backport: Zoekt: Index pending delete projects
• [Backport 17.9] Update truncato gem
• Reorder runners backfill migrations - 17.9 backport
• [Backport 17.9] Replace #test-platform in favour of #s_developer_experience
• Update Gitaly client dependency to include DNS lookup change (backport to 17.9)
• Backport ‘ci-internal-release-docker-branch-dev’ into ‘17-9-stable’
• Backport 17.9: Update container-registry to v4.15.2-gitlab

17.8.6

• UBI/FIPS: Fixup container_version when not using gitlab-base
• 17.8 Backport: jliu/gitaly-dns-tls
• Fix a spec typo in merge_requests_controller_spec
• Update Gitaly client dependency to include DNS lookup change (backport 17.8)
• [Backport 17.8] Replace #test-platform in favour of #s_developer_experience
• Fix SPP worker bug in 17.8
• Reorder runners backfill migrations - 17.8 backport
• Backport ‘ci-internal-release-docker-branch-dev’ into ‘17-8-stable’

Updating

To update GitLab, see the Update page. To update Gitlab Runner, see the Updating the Runner page.

Receive Patch Notifications

To receive patch blog notifications delivered to your inbox, visit our contact us page. To receive release notifications via RSS, subscribe to our patch release RSS feed or our RSS feed for all releases.

We’re combining patch and security releases

This improvement in our release process matches the industry standard and will help GitLab users get information about security and bug fixes sooner, read the blog post here.

On March 12, 2025, we released versions 17.9.2, 17.8.5, 17.7.7 for GitLab Community Edition (CE) and Enterprise Edition (EE).

These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action and will be notified once their instance has been patched.

GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases: scheduled releases, and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays. For more information, you can visit our releases handbook and security FAQ. You can see all of GitLab release blog posts here.

For security fixes, the issues detailing each vulnerability are made public on our issue tracker 30 days after the release in which they were patched.

We are committed to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers upgrade to the latest patch release for their supported version. You can read more best practices in securing your GitLab instance in our blog post.

Recommended Action

We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible.

When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.

Security fixes

Table of security fixes

CVE-2025-25291 and CVE-2025-25292 (third party gem ruby-saml)

GitLab has remediated two privately disclosed security issues (CVE-2025-25291, CVE-2025-25292) identified in the ruby-saml library which GitLab uses when SAML SSO authentication is enabled at the instance or group level. These issues have been remediated on GitLab.com, and in GitLab CE/EE versions 17.7.7, 17.8.5, and 17.9.2.

On GitLab CE/EE instances using SAML authentication, under certain circumstances, an attacker with access to a valid signed SAML document from the IdP could authenticate as another valid user within the environment’s SAML IdP.

Self Managed GitLab: Known Mitigations

Affected customers who cannot immediately update GitLab CE/EE to address these issues may choose to perform the following mitigation steps:

Note: This vulnerability requires the attacker to have compromised a valid user account to perform the authentication bypass.

1. Enable GitLab two-factor authentication for all user accounts on the GitLab self-managed instance (NOTE: Enabling identity provider multi-factor authentication does not mitigate this vulnerability) and
2. Do not allow the SAML two-factor bypass option in GitLab and
3. Require admin approval for automatically created new users (gitlab_rails['omniauth_block_auto_created_users'] = true)

GitLab Thanks:

• ahacker1 for reporting CVE-2025-25291 through our HackerOne bug bounty program
• Peter Stöckli (GitHub) for identifying CVE-2025-25292 and contacting GitLab to coordinate disclosure and remediation across vendors
• Sixto Martin Garcia (maintainer of the ruby-saml RubyGem) for their collaboration on remediation and coordinating disclosure

CVE-2025-27407 (third party gem graphql)

GitLab has remediated a privately disclosed security issue (CVE-2025-27407) identified in the Ruby graphql library, which affects and has been remediated in GitLab.com, and in GitLab CE/EE versions 17.7.7, 17.8.5, and 17.9.2.

Under certain circumstances, if an attacker-controlled authenticated user account attempted to transfer a maliciously-crafted project via the Direct Transfer feature (note: Direct transfer is in beta stage and is disabled by default for all self-managed Gitlab instances), remote code execution is possible. Disabling Direct Transfer removes risk of exploitation from this issue.

Self-managed GitLab: Known Mitigations

Affected customers who cannot immediately update their GitLab CE/EE to address these issues may choose to perform the following mitigation steps:

• Disable migration of groups and projects by direct transfer, if enabled (disabled by default)

GitLab Thanks:

• yvvdwf for reporting this vulnerability through our HackerOne bug bounty program
• Robert Mosolgo (ruby-graphql) for their collaboration on cross-vendor disclosure and remediation

Denial of Service Due to Inefficient Processing of Untrusted Input

An issue was discovered in GitLab CE/EE affecting all versions before 17.7.7, 17.8 prior to 17.8.5, and 17.9 prior to 17.9.2. where a denial of service vulnerability could allow an attacker to cause a system reboot under certain conditions. This is a medium severity issue (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 5.7). It is now mitigated in the latest release and is assigned CVE-2024-13054.

Thanks sim4n6 for reporting this vulnerability through our HackerOne bug bounty program.

Credentials disclosed when repository mirroring fails

An issue was discovered in GitLab EE/CE affecting all versions starting from 11.5 before 17.7.7, all versions starting from 17.8 before 17.8.5, all versions starting from 17.9 before 17.9.2. Certain user inputs in repository mirroring settings could potentially expose sensitive authentication information. This is a medium severity issue (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N, 4.4). It is now mitigated in the latest release and is assigned CVE-2024-12380.

Thanks sigitsetiawansss for reporting this vulnerability through our HackerOne bug bounty program.

Denial of Service Vulnerability in GitLab Approval Rules due to Unbounded Field

An issue was discovered in GitLab EE affecting all versions starting with 12.3 before 17.7.7, 17.8 prior to 17.8.5, and 17.9 prior to 17.9.2. A vulnerability in certain GitLab instances could allow an attacker to cause a denial of service condition by manipulating specific API inputs. This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, 6.5). It is now mitigated in the latest release and is assigned CVE-2025-1257.

Thanks pwnie for reporting this vulnerability through our HackerOne bug bounty program.

Internal Notes in Merge Requests Are Emailed to Non-Members Upon Review Submission

An issue has been discovered in GitLab EE/CE affecting all versions starting from 16.9 before 17.7.7, all versions starting from 17.8 before 17.8.5, all versions starting from 17.9 before 17.9.2 could allow unauthorized users to access confidential information intended for internal use only. This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, 4.3). It is now mitigated in the latest release and is assigned CVE-2025-0652.

Thanks foxribeye for reporting this vulnerability through our HackerOne bug bounty program.

Maintainer can inject shell code in Google integrations

An issue was discovered in GitLab EE affecting all versions starting from 17.2 before 17.7.7, all versions starting from 17.8 before 17.8.5, all versions starting from 17.9 before 17.9.2. An input validation issue in the Google Cloud IAM integration feature could have enabled a Maintainer to introduce malicious code. This is a low severity issue (CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N, 3.7). It is now mitigated in the latest release and is assigned CVE-2024-8402.

Thanks joaxcar for reporting this vulnerability through our HackerOne bug bounty program.

Guest with custom Admin group member permissions can approve the users invitation despite user caps

An issue was discovered in GitLab EE affecting all versions from 16.5 prior to 17.7.7, 17.8 prior to 17.8.5, and 17.9 prior to 17.9.2 which allowed a user with a custom permission to approve pending membership requests beyond the maximum number of allowed users. This is a low severity issue (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N, 2.7). It is now mitigated in the latest release and is assigned CVE-2024-7296.

Thanks ashish_r_padelkar for reporting this vulnerability through our HackerOne bug bounty program.

Bump PostgreSQL versions to 14.17 and 16.8

The PostgreSQL project released an update so we are updating to versions 14.17 and 16.8.

Bug fixes

17.9.2

• PG: Upgrade client libraries and programs to 16.8
• Use correct project when fetching managed resources templates
• E2E test fix: web ide spec
• Prevent deletion of project_bot users with non-expiring access tokens
• Backport: Fix missing repo logic
• Backport: Search times out with certain special characters
• Backport: Fix to support custom pipcompile requirement file with the new DS analyzer
• Update gitlab-development-kit digest to 1305f9b

17.8.5

• Fixes typo on profiles controller spec

17.7.7

• Fixes typo on issues controller spec

Updating

To update GitLab, see the Update page. To update Gitlab Runner, see the Updating the Runner page.

Receive Patch Notifications

To receive patch blog notifications delivered to your inbox, visit our contact us page. To receive release notifications via RSS, subscribe to our patch release RSS feed or our RSS feed for all releases.

We’re combining patch and security releases

This improvement in our release process matches the industry standard and will help GitLab users get information about security and bug fixes sooner, read the blog post here.

On February 26, 2025, we released versions 17.9.1, 17.8.4, 17.7.6 for GitLab Community Edition (CE) and Enterprise Edition (EE).

These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action.

GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases: scheduled releases, and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays. For more information, you can visit our releases handbook and security FAQ. You can see all of GitLab release blog posts here.

For security fixes, the issues detailing each vulnerability are made public on our issue tracker 30 days after the release in which they were patched.

We are committed to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers upgrade to the latest patch release for their supported version. You can read more best practices in securing your GitLab instance in our blog post.

Recommended Action

We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible.

When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.

Security fixes

Table of security fixes

XSS in k8s proxy endpoint

An issue has been discovered in GitLab CE/EE affecting all versions from 15.10 prior to 17.7.6, 17.8 prior to 17.8.4, and 17.9 prior to 17.9.1. A proxy feature could potentially allow unintended content rendering leading to XSS under specific circumstances. This is a high severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N, 8.7). It is now mitigated in the latest release and is assigned CVE-2025-0475.

Thanks joaxcar for reporting this vulnerability through our HackerOne bug bounty program.

XSS Maven Dependency Proxy

A Cross Site Scripting (XSS) vulnerability in GitLab-EE affecting all versions from 16.6 prior to 17.7.6, 17.8 prior to 17.8.4, and 17.9 prior to 17.9.1 allows an attacker to bypass security controls and execute arbitrary scripts in a user’s browser under specific conditions. This is a high severity issue (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N, 7.7). It is now mitigated in the latest release and is assigned CVE-2025-0555.

Thanks joaxcar for reporting this vulnerability through our HackerOne bug bounty program.

HTML injection leads to XSS on self hosted instances

An issue has been discovered in GitLab CE/EE affecting all versions from 16.6 before 17.7.6, 17.8 before 17.8.4, and 17.9 before 17.9.1. An attacker could inject HMTL into the child item search potentially leading to XSS in certain situations. This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, 5.4). It is now mitigated in the latest release and is assigned CVE-2024-8186.

Thanks joaxcar for reporting this vulnerability through our HackerOne bug bounty program.

Improper Authorisation Check Allows Guest User to Read Security Policy

A vulnerability in GitLab-EE affecting all versions from 16.2 prior to 17.7.6, 17.8 prior to 17.8.4, and 17.9 prior to 17.9.1 allows a Guest user to read Security policy YAML. This is a medium severity issue (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N, 5.3). It is now mitigated in the latest release and is assigned CVE-2024-10925.

Thanks yuki_osaki for reporting this vulnerability through our HackerOne bug bounty program.

Planner role can read code review analytics in private projects

Improper authorization in GitLab EE affecting all versions from 17.7 prior to 17.7.6, 17.8 prior to 17.8.4, 17.9 prior to 17.9.1 allow users with limited permissions to access potentially sensitive project analytics data. This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, 4.3). It is now mitigated in the latest release and is assigned CVE-2025-0307.

Thanks weasterhacker for reporting this vulnerability through our HackerOne bug bounty program.

Bug fixes

17.9.1

• Backport - Merge branch ‘revert-e78b1a9f’ into ‘master’
• Backport/fix ambiguous pipeline 17 9
• Make it possible for ignore unexpected EOFs in SSL connections
• Allow Duo Chat to be resizable on self-managed (backport)
• Merge branch ‘mdc/include-build-assets-image-job-sync-pipelines’ into ‘master’
• Fix instance level dashboard by default severity override

17.8.4

• Bump gitlab-exporter to v15.2.0
• [Backport] Return false for pending_migrations? if indexing disabled
• Merge branch ‘10443-fix-workhorse-verify’ into ‘master’
• Revert stricter workhorse route regexes
• Use primary DB when authenticating via job token in jobs API
• Backport/fix ambiguous pipeline 17 8
• Backport add more custom exit codes for CI/CD failures MRs and fix assets caching in scheduled cache-assets:production job
• Backport fix CH version incompatibility
• Merge branch ‘mdc/include-build-assets-image-job-sync-pipelines’ into ‘master’
• Make it possible for ignore unexpected EOFs in SSL connections
• Update dependency gitlab-exporter to v15.2.0
• [Backport] Return false for pending_migrations? if indexing disabled
• Merge branch ‘10443-fix-workhorse-verify’ into ‘master’
• Revert stricter workhorse route regexes
• Use primary DB when authenticating via job token in jobs API

17.7.6

• Merge branch ‘10443-fix-workhorse-verify’ into ‘master’
• Revert stricter workhorse route regexes
• Fix failed jobs widget polling issue
• Backport fix for ambiguous created_at
• Backport add more custom exit codes for CI/CD failures MRs and fix assets caching in scheduled cache-assets:production job
• Merge branch ‘mdc/include-build-assets-image-job-sync-pipelines’ into ‘master’
• Make it possible for ignore unexpected EOFs in SSL connections
• Merge branch ‘10443-fix-workhorse-verify’ into ‘master’
• Revert stricter workhorse route regexes

Updating

To update GitLab, see the update page. To update Gitlab Runner, see the Updating the Runner page.

Note: GitLab releases have skipped 17.7.5 and 17.8.3. There are no patches with these version numbers.

Receive Patch Notifications

To receive patch blog notifications delivered to your inbox, visit our contact us page. To receive release notifications via RSS, subscribe to our patch release RSS feed or our RSS feed for all releases.

We’re combining patch and security releases

This improvement in our release process matches the industry standard and will help GitLab users get information about security and bug fixes sooner, read the blog post here.

On February 12, 2025, we released versions 17.8.2, 17.7.4, 17.6.5 for GitLab Community Edition (CE) and Enterprise Edition (EE).

These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action.

GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases: scheduled releases, and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays. For more information, you can visit our releases handbook and security FAQ. You can see all of GitLab release blog posts here.

For security fixes, the issues detailing each vulnerability are made public on our issue tracker 30 days after the release in which they were patched.

We are committed to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers upgrade to the latest patch release for their supported version. You can read more best practices in securing your GitLab instance in our blog post.

Recommended Action

We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible.

When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.

Security fixes

Table of security fixes

A CSP-bypass XSS in merge-request page

An XSS vulnerability exists in GitLab CE/EE affecting all versions from 13.3 prior to 17.6.5, 17.7 prior to 17.7.4 and 17.8 prior to 17.8.2 that allows an attacker to execute unauthorized actions via a change page. This is a high severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N, 8.7). It is now mitigated in the latest release and is assigned CVE-2025-0376.

Thanks yvvdwf for reporting this vulnerability through our HackerOne bug bounty program.

Denial of Service due to Unbounded Symbol Creation

A denial of service vulnerability in GitLab CE/EE affecting all versions from 14.1 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 allows an attacker to impact the availability of GitLab via unbounded symbol creation via the scopes parameter in a Personal Access Token. This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 6.5). It is now mitigated in the latest release and is assigned CVE-2024-12379.

Thanks sim4n6 for reporting this vulnerability through our HackerOne bug bounty program.

Exfiltrate content from private issues using Prompt Injection

An issue was discovered in GitLab EE affecting all versions starting from 16.0 prior to 17.6.5, starting from 17.7 prior to 17.7.4, and starting from 17.8 prior to 17.8.2, which allows an attacker to exfiltrate contents of a private issue using prompt injection. This is a medium severity issue (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N, 6.4). It is now mitigated in the latest release and is assigned CVE-2024-3303.

Thanks joaxcar for reporting this vulnerability through our HackerOne bug bounty program.

Internal HTTP header leak via route confusion in workhorse

An information disclosure vulnerability in GitLab CE/EE affecting all versions from 8.3 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 allows an attacker to send a crafted request to a backend server to reveal sensitive information. This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, 4.3). It is now mitigated in the latest release and is assigned CVE-2025-1212.

This vulnerability has been discovered internally by GitLab team member Joern Schneeweisz.

SSRF via workspaces

An external service interaction vulnerability in GitLab EE affecting all versions from 15.11 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 allows an attacker to send requests from the GitLab server to unintended services. This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, 4.3). It is now mitigated in the latest release and is assigned CVE-2024-9870.

Thanks retr02332 for reporting this vulnerability through our HackerOne bug bounty program.

Unauthorized Incident Closure and Deletion by Planner Role in GitLab

Improper Authorization in GitLab CE/EE affecting all versions from 17.7 prior to 17.7.4, 17.8 prior to 17.8.2 allow users with limited permissions to perform unauthorized actions on critical project data. This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, 4.3). It is now mitigated in the latest release and is assigned CVE-2025-0516.

Thanks sp4rrow for reporting this vulnerability through our HackerOne bug bounty program.

ActionCable does not invalidate tokens after revocation

An issue discovered in GitLab CE/EE affecting all versions from 16.11 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 meant that long-lived connections in ActionCable potentially allowed revoked Personal Access Tokens access to streaming results. This is a medium severity issue (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N, 4.2). It is now mitigated in the latest release and is assigned CVE-2025-1198.

This vulnerability has been discovered internally by a GitLab team member Dylan Griffith.

A custom permission may allow overriding Repository settings

An improper access control vulnerability in GitLab EE affecting all versions from 15.7 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 allows a user with a custom permission to view contents of a repository even if that access is not authorized. This is a low severity issue (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N, 2.7). It is now mitigated in the latest release and is assigned CVE-2025-1042.

Thanks mateuszek for reporting this vulnerability through our HackerOne bug bounty program.

SAML Authentication Misconfigures External User Attribute

An issue has been discovered in GitLab CE/EE for Self-Managed and Dedicated instances affecting all versions from 17.5 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2. It was possible for a user manually designated as an External without configuring them as such in SAML response to lose that designation, and to read and clone internal projects under certain circumstances. After upgrading to a patched version, please review and re-designate any externals users. This is a low severity issue (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N, 3.1). It is now mitigated in the latest release and is assigned CVE-2025-1540.

Thanks Renato Alves for reporting this vulnerability.

Mattermost Security Updates January 22, 2025

Mattermost has been updated to versions 10.2.3, which contains several patches and security fixes.

Bug fixes

17.8.2

• Fix Workhorse failing on 64-bit unaligned access on Raspberry Pi 32-bit
• [Backport] Fixed css bug for command palette file names too long
• Merge branch ‘fix-environment-check-user-creation’ into ‘17-8-stable-ee’
• 17.8: Ensure user external attribute is preserved and not set to nil
• Backporting the bug: Remove feature flag for multiple approvals
• Merge branch ‘dattang/do-not-allow-release-environment-to-fail’ into ‘master’
• Fix Approval widget for project merge request settings
• Enable ai tracking without move_ai_tracking_to_instrumentation_layer flag
• Add import_vulnerabilities feature flag
• Update build-gdk-image version
• Backport: Zoekt code search always performs regex search
• Fix storing incorrect policy index in scan_result_policies
• [Backport] Only check pending migrations if indexing enabled
• Updating Duo functionality note
• [backport] Fix command palette keybindings propagation
• Backport into 17.8: Decrease log level of false error
• [Backport] Fix info and list_pending_migration rake tasks if search cluster unreachable

17.7.4

• 17.7: Ensure user external attribute is preserved and not set to nil
• Merge branch ‘fix-environment-check-user-creation’ into ‘master’
• Merge branch ‘dattang/do-not-allow-release-environment-to-fail’ into ‘master’
• Fixes typo on profiles_controller_spec
• Add import_vulnerabilities feature flag
• Updating Duo functionality note
• Backport into 17.7: Decrease log level of false error

17.6.5

• Backport internal release support to 17.6
• 17.6: Ensure user external attribute is preserved and not set to nil
• Merge branch ‘dattang/do-not-allow-release-environment-to-fail’ into ‘master’
• Fixes typo on profiles_controller_spec
• Backport internal release support to 17.6

Updating

To update GitLab, see the update page. To update Gitlab Runner, see the Updating the Runner page.

Receive Patch Notifications

To receive patch blog notifications delivered to your inbox, visit our contact us page. To receive release notifications via RSS, subscribe to our patch release RSS feed or our RSS feed for all releases.

We’re combining patch and security releases

This improvement in our release process matches the industry standard and will help GitLab users get information about security and bug fixes sooner, read the blog post here.

On January 22, 2025, we released versions 17.8.1, 17.7.3, 17.6.4 for GitLab Community Edition (CE) and Enterprise Edition (EE).

These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action.

GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases: scheduled releases, and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays. For more information, you can visit our releases handbook and security FAQ. You can see all of GitLab release blog posts here.

For security fixes, the issues detailing each vulnerability are made public on our issue tracker 30 days after the release in which they were patched.

We are committed to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers upgrade to the latest patch release for their supported version. You can read more best practices in securing your GitLab instance in our blog post.

Recommended Action

We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible.

When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.

Security fixes

Table of security fixes

Stored XSS via Asciidoctor render

An issue has been discovered in GitLab CE/EE affecting all versions from 17.2 before 17.6.4, 17.7 before 17.7.3, and 17.8 before 17.8.1. Improper rendering of certain file types lead to cross-site scripting. This is a high severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N, 8.7). It is now mitigated in the latest release and is assigned CVE-2025-0314.

Thanks yvvdwf for reporting this vulnerability through our HackerOne bug bounty program.

Developer could exfiltrate protected CI/CD variables via CI lint

An issue has been discovered in GitLab CE/EE affecting all versions starting from 17.0 prior to 17.6.4, from 17.7 prior to 17.7.3, and from 17.8 prior to 17.8.1. Under certain conditions, it may have been possible for users with developer role to exfiltrate protected CI/CD variables via CI lint. This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, 6.4). It is now mitigated in the latest release and is assigned CVE-2024-11931.

This vulnerability was internally discovered and reported by GitLab team member Greg Myers.

Cyclic reference of epics leads resource exhaustion

An issue was discovered in GitLab CE/EE affecting all versions starting from 15.7 prior to 17.6.4, starting from 17.7 prior to 17.7.3, and starting from 17.8 prior to 17.8.1. It was possible to trigger a DoS by creating cyclic references between epics. This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L, 4.3). It is now mitigated in the latest release and is assigned CVE-2024-6324.

Thanks xorz for reporting this vulnerability through our HackerOne bug bounty program.

Bug fixes

17.8.1

• Private profiles showed account creation dates although documentation stated they shouldn’t

17.7.3

• Private profiles showed account creation dates although documentation stated they shouldn’t

17.6.4

• Toolbox: update URLs for AzCopy (upstream change) - 17-6-stable
• Private profiles showed account creation dates although documentation stated they shouldn’t

Updating

To update GitLab, see the update page. To update Gitlab Runner, see the Updating the Runner page.

Receive Patch Notifications

To receive patch blog notifications delivered to your inbox, visit our contact us page. To receive release notifications via RSS, subscribe to our patch release RSS feed or our RSS feed for all releases.

We’re combining patch and security releases

This improvement in our release process matches the industry standard and will help GitLab users get information about security and bug fixes sooner, read the blog post here.

On January 15, 2025, we released versions 17.7.2 for GitLab Community Edition and Enterprise Edition.

These versions resolve a number of regressions and bugs. This patch release does not include any security fixes.

GitLab Community Edition and Enterprise Edition

17.7.2

• Merge branch ‘azcopy-url-20250108’ into ‘17-7-stable’
• Fixes issue where some merge request diffs with associated comments were not visible. This does not correct the display issue for existing records, but does prevent new instances of this occurrence.
• Remove download_code dependency from access to read merge requests
• Fix handling of short gzip metadata files

Important notes on upgrading

If you had previously upgraded to GitLab 17.7.0 or 17.7.1 this patch is recommended to prevent any further occurrences of merge request comments being unable to be displayed. A future release will correct the display issue for affected records.

This version does not include any new migrations, and for multi-node deployments, should not require any downtime.

Please be aware that by default the Omnibus packages will stop, run migrations, and start again, no matter how “big” or “small” the upgrade is. This behavior can be changed by adding a /etc/gitlab/skip-auto-reconfigure file, which is only used for updates.

Updating

To update, check out our update page.

GitLab subscriptions

Access to GitLab Premium and Ultimate features is granted by a paid subscription.

Alternatively, sign up for GitLab.com to use GitLab’s own infrastructure.

We’re combining patch and security releases

This improvement in our release process matches the industry standard and will help GitLab users get information about security and bug fixes sooner, read the blog post here.

On January 8, 2025, we released versions 17.7.1, 17.6.3, 17.5.5 for GitLab Community Edition (CE) and Enterprise Edition (EE).

These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action.

GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases: scheduled releases, and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays. For more information, you can visit our releases handbook and security FAQ. You can see all of GitLab release blog posts here.

For security fixes, the issues detailing each vulnerability are made public on our issue tracker 30 days after the release in which they were patched.

We are committed to ensuring all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. As part of maintaining good security hygiene, it is highly recommended that all customers upgrade to the latest patch release for their supported version. You can read more best practices in securing your GitLab instance in our blog post.

Changes to Imports

GitLab released a new user contribution and membership mapping feature for GitLab importers, including Direct Transfer, GitHub, Bitbucket Server, and Gitea importers. This feature is available by default from GitLab 17.7.1. More information on the feature and availability can be found in a blog post and in the documentation here.

Why GitLab changed its importer functionality

Vulnerabilities (CVE-2024-5655, CVE-2024-6385, CVE-2024-6678, CVE-2024-8970) affecting import functionality were discovered through our HackerOne bug bounty program. To address these vulnerabilities and further enhance security, GitLab redesigned the importers’ user contribution mapping functionality.

What’s changing?

1. Post-import mapping: Previously unavailable, this feature allows you to assign imported contributions and memberships to users on the destination instance after completing the import. Imported memberships and contributions are first mapped to placeholder users. Until they are reassigned, contributions will be displayed as associated with placeholders.
2. Email-independent mapping: The new process doesn’t rely on email addresses, allowing you to map contributions for users with different email addresses on source and destination instances.
3. User control: Each user on the destination instance assigned a contribution mapping must accept the assignment before any imported contributions are attributed to them. They can also reject the assignment.

Full details describing improved user contribution and membership mapping features are available in the GitLab docs here.

Guidance for GitLab Self-Managed & Dedicated Customers

1. Exploitation requires that an attacker have an authenticated user account on the target GitLab instance. Therefore, the risk is primarily limited to insider threats unless you allow open internet access and public registrations.

2. GitLab strongly recommends disabling importers until your GitLab instance is upgraded to version 17.7.1 or later. You can disable import features by:

   1. Logging in as a GitLab instance administrator user
   2. Go to Admin > Settings > General > Import and Export settings
   3. Uncheck the box next to each enabled importer
   4. Click Save Changes

3. If you must enable an importer, GitLab recommends temporarily enabling it during an import and disabling the feature after the import is complete.

4. GitLab Self-Managed with Direct Transfer (beta feature) or GitHub, Bitbucket Server, or Gitea importers enabled may be vulnerable and should be upgraded immediately.

Recommended Action

We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible.

When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.

Security fixes

Table of security fixes

Possible access token exposure in GitLab logs

An issue was discovered in GitLab CE/EE affecting all versions starting from 17.4 prior to 17.5.5, starting from 17.6 prior to 17.6.3, and starting from 17.7 prior to 17.7.1. Under certain conditions, access tokens may have been logged when API requests were made in a specific manner. This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N, 6.5). It is now mitigated in the latest release and is assigned CVE-2025-0194.

This vulnerability has been discovered internally by GitLab team member Thong Kuah.

Cyclic reference of epics leads resource exhaustion

An issue was discovered in GitLab CE/EE affecting all versions starting from 15.7 prior to 17.5.5, starting from 17.6 prior to 17.6.3, and starting from 17.7 prior to 17.7.1. It was possible to trigger a DoS by creating cyclic references between epics. This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L, 4.3). It is now mitigated in the latest release and is assigned CVE-2024-6324.

Thanks xorz for reporting this vulnerability through our HackerOne bug bounty program.

Unauthorized user can manipulate status of issues in public projects

An issue was discovered in GitLab CE/EE affecting all versions starting from 15.5 before 17.5.5, 17.6 before 17.6.3, and 17.7 before 17.7.1, in which unauthorized users could manipulate the status of issues in public projects. This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, 4.3). It is now mitigated in the latest release and is assigned CVE-2024-12431.

Thanks pwnie for reporting this vulnerability through our HackerOne bug bounty program.

Instance SAML does not respect external_provider configuration

An issue was discovered in GitLab CE/EE affecting all versions starting from 16.4 prior to 17.5.5, starting from 17.6 prior to 17.6.3, and starting from 17.7 prior to 17.7.1. When a user is created via the SAML provider, the external groups setting overrides the external provider configuration. As a result, the user may not be marked as external thereby giving those users access to internal projects or groups. This is a medium severity issue (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N, 4.3). It is now mitigated in the latest release and is assigned CVE-2024-13041.

This vulnerability has been discovered internally by GitLab team member Drew Blessing.

Bug fixes

17.7.1

• Cherry pick fix for gsutil into ‘17-7-stable’
• backport 17.7.x: Downgrade grpc-go to v1.66.3
• Backport Revert “Merge branch ‘improve_reference_rewriter_to_work_cross_groups’ into ‘master’”
• 17.7 Backport Reject system notes when indexing notes on work items
• Merge branch ‘andrey-fix-qa-spec’ into 17.7
• Merge branch ‘release-unique-users’ into 17.7
• Fix CI job token signing key not always generated
• Update acme-client to v2.0.19

17.6.3

• Cherry pick ‘2125-base-force-upgrade-ubi’ into ‘17-6-stable’
• Cherry pick fix for gsutil into ‘17-6-stable’
• backport 17.6.x: Downgrade grpc-go to v1.66.3
• Backport Advanced Search: Set engine for OpenSearch indices
• 17.6: Fix ability to use password for Git when password for Web is disabled
• Backport running release-environments QA from the stable branch to 17.6
• Backport ‘fix-env-var-for-release-environments-qa’ 17.6
• Backport ‘dattang/fix-build-gdk-image-script’ to 17.6
• Backport fix for diff_files highlights preload to 17.6
• Quarantines iteration qa spec
• Quarantine outdated user_views_iteration_spec.rb
• Quarantine date sensitive specs 17.6

17.5.5

• Cherry pick ‘2125-base-force-upgrade-ubi’ into ‘17-5-stable’
• Cherry pick fix for gsutil into ‘17-5-stable’
• backport 17.5.x: Update changelog for 17.5.0
• Backport running release-environments QA from the stable branch to 17.5
• Backport ‘dattang/allow-release-environments-to-fail’ to 17.5
• Backport fix for diff_files highlights preload to 17.5
• Backport ‘dattang/fix-build-gdk-image-script’ to 17.5
• Quarantines iteration qa spec
• Quarantine outdated user_views_iteration_spec.rb
• Quarantine date sensitive specs 17.5
• bump devfile gem to 0.0.28 patch
• 17.5: Fix ability to use password for Git when password for Web is disabled