GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have…
At a glance
Low rather than Medium: UK relevance is 40 of 100, little UK-specific signal so far.
Briefing
- Organisations using affected GitLab versions should prioritise upgrading to the latest releases to address the security fixes.
- IT leaders should verify if their GitLab installations are running versions requiring upgrade as per the released patches.
Questions to ask IT
- Do we run GitLab, and which versions?
- Is any of it reachable from the internet?
- If it is still not patched, what mitigation is in place, and what is holding the fix up?
Next steps
- Confirm whether this affects systems or suppliers in your estate
Vulnerability facts
Full CVE detail CVE-2026-89078- 9.9 · CriticalExploitable over the network with a low-privilege account, and no one has to click or open anything. High impact on confidentiality and integrity; low on availability, and it can reach beyond the vulnerable system.CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
- Not listed
- 19.2 before 19.2.7, 19.3 before 19.3.3, 19.4 before 19.4.1
- 19.2.7, 19.3.3, 19.4.1
These facts are for CVE-2026-89078. This event covers 1 more CVE, each with its own record. Versions are as the CVE record states them; check the vendor advisory before planning a fix.
- The remediated issue affects GitLab CE/EE versions 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 under specific conditions.
- Versions 19.4.1, 19.3.3, and 19.2.7 were released on 23 September 2026, with security fixes for affected installations.
- Two confirmed CVEs, CVE-2026-89078 and CVE-2026-93577, are associated with this event.
Next steps
- Review the advisory against your asset inventory and patch cadence
Summary
- GitLab has addressed a security issue in GitLab CE/EE affecting versions 19.2 prior to 19.2.7, 19.3 prior to 19.3.3, and 19.4 prior to 19.4.1 that could have been exploited under specific conditions.
- New versions 19.4.1, 19.3.3, and 19.2.7 were released on 23 September 2026, containing security fixes and recommended for immediate upgrade by all self-managed GitLab installations.
Read the original reportGitLab security releases(opens in a new tab)
Products and services involved
- GitLab93% match confidence · CVE-2026-89078
Pulse
Last change 5d ago · Recheck overdue since 4 Nov 2026, 18:20 UK time
- Story3 Nov 2026, 18:20 UK time · 5d ago
Linked reporting from GitLab security releases (vendor psirt).
Read source (GitLab security releases)
1 entry so far. The timeline chart appears once this story has more history.
Sources
- GitLab security releasesVendor
GitLab Critical Patch Release: 19.4.1, 19.3.3, 19.2.7
How we know
Statements extracted from sources. Higher confidence means stronger corroboration.
- ClaimedHeadline60% confidence
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have…
- ProbableSummary fact75% confidence
On 23 September 2026, we released versions 19.4.1, 19.3.3, 19.2.7 for GitLab Community Edition (CE) and Enterprise Edition (EE). These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately.
- ConfirmedCVE identifier95% confidence
Event involves CVE-2026-89078
- ConfirmedCVE identifier95% confidence
Event involves CVE-2026-93577