Tag

#self-managed

Tagged “self-managed”

3 articles

GitLab's CVSS 10 fix lives in the CI config parser

GitLab released 19.4.2, 19.3.5 and 19.2.8 on 12 October to fix a CVSS 10.0 flaw in its CI/CD regular expression compiler that could let an unauthenticated user run code on the server. GitLab.com is already patched; self-managed instances need to upgrade.

Oct 13, 2026 · Tomás Vega Security

GitLab ships critical patch across 19.4, 19.3 and 19.2

GitLab published a cross-branch security patch on 23 September covering 19.4.1, 19.3.3 and 19.2.7, with fixes rated up to Critical and self-managed operators asked to upgrade as soon as possible.

Sep 29, 2026 · Maya Okonkwo Security & supply chain

GitLab's critical patch: unauth file read from the commits API

GitLab 19.3.2, 19.2.6 and 19.1.8 ship eighteen CVEs' worth of fixes, including a Critical unauthenticated arbitrary-file read on the repository commits API. Self-managed operators have a downtime problem stacked on top of a rotate-your-CI-variables problem.

Sep 11, 2026 · Tomás Vega