GitLab Patches Critical Flaws Letting Attackers Leak Data, Alter Pipelines

Key Takeaways

• GitLab has rolled out urgent security updates addressing 13 vulnerabilities across its Community and Enterprise Editions.
• The flaws range in severity from high to low, with critical issues potentially leading to sensitive data exposure, unauthorized CI/CD pipeline manipulation, and denial of service.
• Affected versions include GitLab CE/EE before 19.2.1, 19.1.3, and 19.0.5.
• Self-managed GitLab users are strongly advised to upgrade their installations immediately; GitLab.com is already patched, and GitLab Dedicated customers require no action.

GitLab Addresses Critical Flaws Impacting Data, Pipelines, and Availability

GitLab has released crucial security patches to mitigate 13 vulnerabilities that could allow attackers to exfiltrate sensitive data, tamper with CI/CD pipelines, and disrupt server operations. The flaws affect both the Community Edition (CE) and Enterprise Edition (EE) of the widely used DevOps platform.

The latest security updates, versions 19.2.1, 19.1.3, and 19.0.5, were deployed on July 29, 2026. These releases contain fixes for a spectrum of issues, categorized as high, medium, and low severity.

GitLab is urging all self-managed instance administrators to apply these updates without delay. Users of GitLab.com are already operating on patched versions, and GitLab Dedicated customers do not need to take any specific action.

Details of High-Severity Vulnerabilities

Among the most pressing vulnerabilities is CVE-2026-6267, a high-severity flaw with a CVSS score of 8.5. This issue resides within GitLab Workhorse and could enable authenticated users with Developer-level permissions to access sensitive information from internal requests due to inadequate access control mechanisms.

Another significant risk, identified as CVE-2026-12436, involves a mass-assignment vulnerability in the Pipeline Schedule API. This flaw could allow malicious actors to modify CI/CD configurations belonging to other users, potentially leading to unauthorized execution of pipelines and significant disruption.

GitLab also addressed CVE-2026-15975, a denial-of-service (DoS) vulnerability exploitable by unauthenticated attackers. By abusing insufficient resource throttling within merge request discussions, attackers could crash or severely degrade server performance, impacting the availability of production environments.

Medium-Severity Issues and Emerging Risks

Several medium-severity vulnerabilities have also been patched, primarily affecting authorization and access control. These include improper authorization within project import functionalities, unauthorized access to pipeline test reports, and the exposure of confidential issue titles through merge request metadata.

A race condition in merge request approval rules, CVE-2026-13113, was also fixed. This flaw could permit code to be merged into protected branches without the required approvals, posing a direct threat to software integrity and security.

The update further resolves a cross-site scripting (XSS) vulnerability, CVE-2026-3093, which could facilitate the execution of malicious JavaScript via specially crafted URLs. Additionally, two vulnerabilities highlight risks in AI-assisted development tools: a prompt injection flaw, CVE-2026-15077, in GitLab Duo Code Review, and an issue in Duo Workflows, CVE-2026-15831, allowing governance controls to be bypassed due to incorrect token generation.

A hypothetical attack scenario described involves a low-privilege developer exploiting a flaw in the Pipeline Schedule API to alter scheduled jobs in a separate project. This could enable the injection of malicious scripts into the CI/CD pipeline, potentially leading to supply chain compromises, unauthorized deployments, or data exfiltration without immediate detection.

GitLab adheres to responsible disclosure practices, stating that all vulnerabilities will be publicly disclosed 90 days after patches are released. The company underscored the critical importance of maintaining up-to-date installations to safeguard sensitive code repositories and development workflows.

The patch release necessitates database migrations, which may lead to downtime for single-node deployments. However, multi-node environments can implement these updates using zero-downtime upgrade procedures.

What You Should Do

• Immediate Upgrade: All self-managed GitLab CE/EE users must upgrade to versions 19.2.1, 19.1.3, or 19.0.5 without delay.
• Review Access Controls: Regularly audit and strengthen access controls, especially for users with Developer-level permissions, to prevent unauthorized data access.
• Audit CI/CD Configurations: Scrutinize CI/CD pipeline configurations for any unauthorized modifications or suspicious scheduled jobs.
• Monitor for Downtime: Be aware that single-node deployments may experience downtime during the upgrade process due to database migrations. Plan accordingly.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.