Do Son 
TL;DR
GitLab shipped a new patch release on August 12, 2026. Versions 19.2.2, 19.1.4, and 19.0.6 fix 13 security flaws across Community and Enterprise Edition. The most severe are high-rated cross-site scripting bugs. GitLab reports no known exploitation.
- Total: 13 CVEs
- Severity: 6 High · 6 Medium · 1 Low
- Actively exploited: None confirmed
- Highest severity: 8.7 (High · CVSSv3) — CVE-2026-15217
- Action: Apply the latest security updates now
Notable CVEs
| CVE | CVSS (CVSSv3) | Type | Fixed in | Status |
|---|---|---|---|---|
| CVE-2026-15217 | 8.7 | CWE-79 | 19.0.6, 19.1.4, 19.2.2 | Not exploited |
| CVE-2026-15216 | 8.7 | CWE-79 | 19.0.6, 19.1.4, 19.2.2 | Not exploited |
| CVE-2026-15423 | 8.5 | CWE-863 | 19.0.6, 19.1.4, 19.2.2 | Not exploited |
| CVE-2026-19228 | 8.5 | CWE-639 | 19.1.4, 19.2.2 | Not exploited |
| CVE-2026-16627 | 7.7 | CWE-79 | 19.2.2 | Not exploited |
| CVE-2026-16494 | 7.1 | CWE-862 | 19.1.4, 19.2.2 | Not exploited |
| CVE-2026-7427 | 5.3 | CWE-770 | 19.0.6, 19.1.4, 19.2.2 | Not exploited |
| CVE-2026-6821 | 4.3 | CWE-862 | 19.0.6, 19.1.4, 19.2.2 | Not exploited |
Why it matters
GitLab holds source code, secrets, and CI/CD pipelines for many teams. So any flaw there can reach sensitive projects. This GitLab patch release closes several high-severity holes.
Most of the top bugs need only developer-role access. Many contributors already hold that role. Therefore, the barrier to abuse is low.
How the attacks work
Two of the worst flaws are cross-site scripting bugs in Analytics Dashboards. Both carry a CVSS score of 8.7. In each case, GitLab failed to sanitize user-controlled values before rendering them.
As a result, an attacker could plant a script through a dashboard field or pagination control. When a victim loads the page, the script runs in their browser. Other fixes address CI/CD authorization and pipeline abuse.
Pipeline and authorization flaws
CVE-2026-15423 stands out among the rest. It let a developer-role user run pipelines on a protected branch without push rights. Several medium bugs also fixed missing authorization checks across APIs.
Affected versions
The flaws affect a range of releases before the fixed builds. Broadly, that means versions before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2. Some issues reach back much further, depending on the CVE.
Exploitation status
GitLab has not confirmed any in-the-wild exploitation. Likewise, no public proof-of-concept exists for these issues. Full issue details go public 90 days after the fix.
Patch and mitigation steps
Upgrade self-managed instances without delay. Move to 19.2.2, 19.1.4, or 19.0.6, whichever matches your branch. There is no workaround, so patching is the only fix.
GitLab.com already runs the patched version. GitLab Dedicated customers need no action. For the full CVE list, read the official GitLab 19.2.2 patch release notes.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
