What happened
On 21 October 2026, GitLab released a critical patch for a bug rated CVSS 10.0 that could let an outsider run code on self-managed servers. GitLab strongly recommends upgrading self-managed installations, and says: “GitLab.com is already running the patched version.” docs.gitlab.com
Recent advisories
If your version starts with the number on the left, you need the one on the right or later.
| Advisory | Rating (vendor) | Fixed in |
|---|---|---|
| GitLab 19.5.1 patch release: CVE-2026-110264CVE-2026-110264Vendor advisorydocs.gitlab.comPublished2026-10-21Last verified2026-10-22 (KST) | Rating (vendor) Critical CVSS 10.0 This fix was also backported to 18.11.13, 19.0.10, 19.1.9 and 19.2.9 | Fixed in
19.4.2, 19.3.5 and 19.2.8 are still affected. 18.11.13, 19.0.10, 19.1.9 and 19.2.9 contain only this one fix, not the 11 other fixes from the same day (see the next row). |
| GitLab 19.5.1 patch release: the 11 other fixesCVE-2026-15723, CVE-2026-112212, CVE-2026-12664, CVE-2026-16255, CVE-2026-105777, CVE-2026-13319, CVE-2026-112378, CVE-2026-105711, CVE-2026-14288, CVE-2026-112326, CVE-2026-103515On the same day GitLab fixed 11 more issues (2 High, 5 Medium, 4 Low). These fixes are only in 19.5.1, 19.4.3 and 19.3.6. If you are on 19.2 or older, you need 19.3.6 or later to get them.Vendor advisorydocs.gitlab.comPublished2026-10-21Last verified2026-10-22 (KST) | Rating (vendor) High 2 High, 5 Medium, 4 Low | Fixed in
GitLab lists these 11 as affecting versions “before 19.3.6”, 19.4 before 19.4.3 and 19.5 before 19.5.1. 18.11.13, 19.0.10, 19.1.9 and 19.2.9 do not include them. |
| GitLab 19.4.2 patch releaseCVE-2026-97229A patch fixing 24 issues, one of them critical. GitLab released 19.4.2, 19.3.5 and 19.2.8. Newer patches on the same branch (19.4.3, 19.3.6 and 19.2.9 from 21 October) include these fixes too.Vendor advisorydocs.gitlab.comPublished2026-10-12Last verified2026-10-22 (KST) | Rating (vendor) Critical Plus 23 other fixes | Fixed in
This patch was released for the 19.2 to 19.4 branches only. If you run an older version, upgrade to a supported branch. For one medium issue (CVE-2026-84284), GitLab lists all 19.3 versions as affected, so moving to 19.4 or later is the safe choice. |
How to check your version
Hosting panel
If a provider runs GitLab for you, their panel or support can tell you the version.
Admin screen or project files
Signed in, open Help → Help. The version is at the top. docs.gitlab.com
Administrators can also open Admin area → Dashboard → Components.
Command line
Run this on the server. docs.gitlab.com
sudo gitlab-rake gitlab:env:info
How to update
Your host or platform runs it
If a provider runs your GitLab, ask them when they will upgrade (message below). GitLab Dedicated tenants on the listed internal versions already have the fix. docs.gitlab.com
You run the server
Follow GitLab's upgrade documentation and the upgrade path for your version.
GitLab notes this patch includes database migrations, so a single-node install has some downtime. Pick a quiet time and take a backup first. docs.gitlab.com
If you can't update yet
GitLab 19.5.1 patch release: CVE-2026-110264
GitLab published detections for security teams, not workarounds. Updating is the fix. docs.gitlab.com
What to ask your host
Copy this, fill in the brackets and send it through your host's support channel.
Hello, we run a self-managed GitLab [address] that you manage for us. GitLab released 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13 on 21 October 2026 and recommends upgrading. Which version are we on, and when can we schedule the upgrade? GitLab notes this patch includes database migrations. Thank you.
Vendor sources
- GitLab 19.5.1 patch releasedocs.gitlab.com
- GitLab 19.4.2 patch releasedocs.gitlab.com
- Find your GitLab versiondocs.gitlab.com
- GitLab maintenance Rake tasksdocs.gitlab.com
Last verified (KST)