Do Son 
TL;DR
GitLab has shipped a new patch release for self-managed installs. Versions 19.2.1, 19.1.3, and 19.0.5 fix 13 security vulnerabilities. The most serious is a high-severity data exposure bug rated 8.5. GitLab reports no known exploitation.
- Total: 13 CVEs
- Severity: 3 High · 9 Medium · 1 Low
- Actively exploited: None confirmed
- Highest severity: 8.5 (High · CVSSv3) — CVE-2026-6267
- Action: Apply the latest security updates now
Notable CVEs
| CVE | CVSS (CVSSv3) | Type | Fixed in | Status |
|---|---|---|---|---|
| CVE-2026-6267 | 8.5 | CWE-201 | 19.0.5, 19.1.3, 19.2.1 | Not exploited |
| CVE-2026-12436 | 8.4 | CWE-915 | 19.0.5, 19.1.3, 19.2.1 | Not exploited |
| CVE-2026-15975 | 7.5 | CWE-770 | 19.0.5, 19.1.3, 19.2.1 | Not exploited |
| CVE-2026-13113 | 6.5 | CWE-367 | 19.0.5, 19.1.3, 19.2.1 | Not exploited |
| CVE-2026-16553 | 5.4 | CWE-522 | 19.0.5, 19.1.3, 19.2.1 | Not exploited |
| CVE-2026-6336 | 5.3 | CWE-863 | 19.0.5, 19.1.3, 19.2.1 | Not exploited |
| CVE-2026-14341 | 4.9 | CWE-862 | 19.0.5, 19.1.3, 19.2.1 | Not exploited |
| CVE-2026-3093 | 4.7 | CWE-79 | 19.0.5, 19.1.3, 19.2.1 | Not exploited |
Why it matters
GitLab holds source code, secrets, and CI/CD pipelines for many teams. So a flaw there can reach sensitive projects fast. Several of these bugs need only a low-privileged account, which most contributors already hold.
Researchers found most issues through GitLab’s HackerOne bug bounty, while staff caught the rest. That mix points to healthy scrutiny of the platform.
How the attacks work
The top issue, CVE-2026-6267, sits in Workhorse. A Developer-role user could reach unauthorized data through weak internal request checks. CVE-2026-12436 follows close behind, letting a user alter another person’s CI/CD pipeline schedule.
An unauthenticated denial-of-service bug, CVE-2026-15975, rounds out the high-severity trio. It abuses weak throttling in merge request discussions. A separate race condition, CVE-2026-13113, could let code merge into a protected branch without required approvals.
Other flaws cover access-control gaps, a stored cross-site scripting bug, and credential exposure in virtual registries.
Two GitLab Duo AI bugs
This GitLab patch release also touches the AI features. CVE-2026-15077 is a prompt injection in Duo Code Review. Meanwhile, CVE-2026-15831 lets a user bypass tool governance policies in Duo Workflows.
Affected versions
The bugs affect a wide range of releases before the fixes. Impacted branches include 19.2 before 19.2.1, 19.1 before 19.1.3, and earlier lines before 19.0.5. Exact ranges vary by CVE.
Patch and mitigation
Upgrade self-managed GitLab now to 19.2.1, 19.1.3, or 19.0.5. GitLab.com already runs the fixed code, and Dedicated customers need no action. For the full list, read the official GitLab patch release notes. No public proof-of-concept has been reported.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
