GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain…
At a glance
Low rather than Medium: UK relevance is 40 of 100, little UK-specific signal so far.
Briefing
- IT leaders should verify if self-managed GitLab installations are running affected versions and apply the latest updates immediately.
- Customers using GitLab.com or GitLab Dedicated do not need to take action as they are already updated with the patched versions.
Questions to ask IT
- Do we run GitLab, and which versions?
- Is any of it reachable from the internet?
- If it is still not patched, what mitigation is in place, and what is holding the fix up?
Next steps
- Confirm whether this affects systems or suppliers in your estate
Vulnerability facts
Full CVE detail CVE-2026-19478- 9.4 · CriticalExploitable over the network without any account, and no one has to click or open anything. High impact on integrity and availability; low on confidentiality.CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
- Not listed
- ~2.2% estimated chance of attack in 30 days
- 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, 19.2 before 19.2.4
- 18.11.11, 19.0.8, 19.1.6, 19.2.4
These facts are for CVE-2026-19478. This event covers 1 more CVE, each with its own record. Versions are as the CVE record states them; check the vendor advisory before planning a fix.
- Versions 19.2.4, 19.1.6, 19.0.8, and 18.11.11 contain security fixes for GitLab CE/EE.
- The issue affects GitLab CE/EE versions 18.2 prior to 18.11.11, 19.0 prior to 19.0.8, 19.1 prior to 19.1.6, and 19.2 prior to 19.2.4.
- GitLab.com and GitLab Dedicated are already running the patched versions and do not require action from customers.
Next steps
- Review the advisory against your asset inventory and patch cadence
Summary
- GitLab has addressed a security issue affecting multiple versions of GitLab CE/EE, including 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4.
- New versions 19.2.4, 19.1.6, 19.0.8, and 18.11.11 were released on 17 August 2026, with security fixes requiring immediate upgrade for self-managed installations.
Read the original reportGitLab security releases(opens in a new tab)
Products and services involved
- GitLab93% match confidence · CVE-2026-19478
Pulse
Last change 5d ago · Recheck overdue since 4 Nov 2026, 18:20 UK time
- Story3 Nov 2026, 18:20 UK time · 5d ago
Linked reporting from GitLab security releases (vendor psirt).
Read source (GitLab security releases)
1 entry so far. The timeline chart appears once this story has more history.
Sources
- GitLab security releasesVendor
GitLab Critical Patch Release: 19.2.4, 19.1.6, 19.0.8, 18.11.11
How we know
Statements extracted from sources. Higher confidence means stronger corroboration.
- ClaimedHeadline60% confidence
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain…
- ProbableSummary fact75% confidence
On 17 August 2026, we released versions 19.2.4, 19.1.6, 19.0.8, 18.11.11 for GitLab Community Edition (CE) and Enterprise Edition (EE). These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. And GitLab Dedicated are already running the patched version. And GitLab Dedicated customers do not need to take action.
- ConfirmedCVE identifier95% confidence
Event involves CVE-2026-19478
- ConfirmedCVE identifier95% confidence
Event involves CVE-2026-19650