GitLab has released security updates for Community Edition and Enterprise Edition to fix multiple vulnerabilities, including two critical flaws that could enable arbitrary file reads and credential theft.
A separate high-severity issue in GitLab Enterprise Edition could allow authenticated attackers to achieve remote code execution by importing a malicious project export. The company released GitLab versions 19.3.2, 19.2.6, and 19.1.8 on September 10, 2026.
GitLab strongly urged all self-managed customers to update immediately. GitLab.com is already running the patched release, while GitLab Dedicated customers do not need to take action.
The most severe vulnerability, tracked as CVE-2026-85706, is a path traversal flaw in the repository commits API affecting both GitLab CE and EE.
The issue received a CVSS score of 10.0. GitLab said an unauthenticated attacker could, under certain conditions, read arbitrary files from an affected GitLab server.
GitLab Patches Critical Flaws
The bug stems from improper path confinement combined with missing authentication enforcement in the repository commits API. An attacker could potentially use crafted path traversal sequences to access files outside the intended repository path.
Depending on the server configuration, exposed data could include application settings, secrets, tokens, SSH keys, database credentials, or other sensitive files accessible to the GitLab process.
CVE-2026-85706 affects GitLab CE and EE versions 18.7 through 19.1.7, 19.2 before 19.2.6, and 19.3 before 19.3.2. Security researcher s3ntago reported the vulnerability through GitLab’s HackerOne bug bounty program.
GitLab also fixed CVE-2026-87719, a critical insecure deserialization vulnerability in the GraphQL subscription serializer for GitLab EE. The flaw has a CVSS score of 9.9 and requires an authenticated user with Duo Chat access.
| CVE | Severity | Impact | Affected Versions |
|---|---|---|---|
| CVE-2026-85706 | Critical (10.0) | Unauthenticated arbitrary file reads | 18.7–19.1.7; 19.2.0–19.2.5; 19.3.0–19.3.1 |
| CVE-2026-87719 | Critical (9.9) | Credential and configuration theft | 18.3–19.1.7; 19.2.0–19.2.5; 19.3.0–19.3.1 |
According to GitLab, an attacker could submit a specially crafted GraphQL subscription argument to bypass serialization controls and trigger server-side object lookup.
This could expose Advanced Search instance configurations and sensitive credentials. The issue affects GitLab EE versions from 18.3 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2.
A third important issue, CVE-2026-88765, is a buffer overflow vulnerability in GitLab EE’s Unicode conversion wrapper. It carries a CVSS score of 8.5 and could allow an authenticated attacker to execute code remotely by importing a specially crafted Git project export.
The overflow occurs during Advanced Search indexing, making systems that accept project imports a notable risk area. GitLab additionally patched high-severity flaws affecting protected CI/CD variables, Markdown rendering, CI/CD environment variable access, and GraphQL resource handling.
These issues could let lower-privileged users access protected variables, make unintended state-changing requests, or cause denial-of-service conditions. Administrators should upgrade to GitLab 19.3.2, 19.2.6, or 19.1.8 based on their supported release branch.
The update includes database migrations, meaning single-node deployments will experience downtime until migrations complete. Multi-node deployments can use GitLab’s zero-downtime upgrade process when properly configured.