GitLab has issued crucial security updates for its Community and Enterprise Editions, addressing multiple vulnerabilities, including two classified as critical. These flaws could potentially enable arbitrary file reads and credential theft, posing significant risks to users.
Critical Vulnerabilities and Their Impact
The company identified a high-severity flaw in its Enterprise Edition that might allow authenticated attackers to execute remote code by importing a malicious project export. The necessary patches have been released in versions 19.3.2, 19.2.6, and 19.1.8 as of September 10, 2026. Users of self-managed GitLab systems are strongly advised to apply these updates immediately, while GitLab.com has already implemented the patched versions.
Details of the Major Security Flaws
The most severe issue, tracked as CVE-2026-85706, involves a path traversal vulnerability within the repository commits API. This flaw affects both GitLab CE and EE, earning a maximum CVSS score of 10.0. Under specific conditions, it could allow an unauthenticated attacker to read arbitrary files from the server. This vulnerability results from inadequate path confinement and missing authentication checks.
Depending on the server setup, the exposed data could include application settings, secrets, tokens, SSH keys, or database credentials. The affected versions include GitLab CE and EE from 18.7 to before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2. The issue was reported by security researcher s3ntago through GitLab’s HackerOne bug bounty program.
Additional Security Concerns and Recommendations
Another critical flaw, identified as CVE-2026-87719, involves insecure deserialization in the GraphQL subscription serializer for GitLab EE. With a CVSS score of 9.9, this flaw requires authenticated user access to Duo Chat and could lead to credential and configuration theft. This vulnerability affects GitLab EE versions from 18.3 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2.
Furthermore, GitLab addressed a buffer overflow vulnerability, CVE-2026-88765, in its Unicode conversion wrapper with a CVSS score of 8.5. This could allow an authenticated attacker to execute code remotely during Advanced Search indexing by importing a specially crafted Git project export.
The update also resolves high-severity issues related to protected CI/CD variables, Markdown rendering, and GraphQL resource handling. These vulnerabilities could enable unauthorized access to protected variables, unintended state changes, or denial-of-service conditions.
Importance of Timely Updates
GitLab urges administrators to upgrade to versions 19.3.2, 19.2.6, or 19.1.8 depending on their branch. The update includes database migrations, which will cause downtime for single-node deployments until completed. Multi-node deployments can utilize GitLab’s zero-downtime upgrade process if configured properly. Prompt updates are essential to protect sensitive data and maintain system security.
