Tag

#patch-release

Tagged “patch-release”

2 articles

GitLab's CVSS 10 fix lives in the CI config parser

GitLab released 19.4.2, 19.3.5 and 19.2.8 on 12 October to fix a CVSS 10.0 flaw in its CI/CD regular expression compiler that could let an unauthenticated user run code on the server. GitLab.com is already patched; self-managed instances need to upgrade.

Oct 13, 2026 · Tomás Vega Security & supply chain

GitLab's mid-month patch train fixes a CI/CD pipeline authorization bypass

GitLab shipped 19.2.2, 19.1.4 and 19.0.6 with 13 CVEs, including an authorization bypass that let developer-role users run CI pipelines against protected branches. Self-managed operators should upgrade immediately.

Aug 13, 2026 · Maya Okonkwo