Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

GitLab self-managed installations immediate upgrade advisory

Advisory/Mitigation
First reported
Last updated
Happening score
H score 45
2 unique sources, 2 articles

Summary

Hide ▲

GitLab issued immediate upgrade guidance for self-managed GitLab installations after fixing two security issues in GitLab CE and GitLab EE. Operators were told to move to 19.3.2, 19.2.6, or 19.1 without delay. The guidance reduces exposure to CVE-2023-2825 and CVE-2026-87719, which can enable arbitrary file reads or sensitive credential theft under certain conditions.

Related Happenings

GitLab incoming email token auth bypass security flaw

Vulnerability
H score22 First: 23.09.2026 19:53 Last: 23.09.2026 19:53 Sources 1

About this happening: GitLab's incoming email token lets a holder act as the account owner, creating unauthorized commit and CI/CD execution risk across projects the user can access. The fe...

Open Happening

GitLab CE/EE repository commits API path traversal (CVE-2026-85706)

Vulnerability
H score43 First: 14.09.2026 10:06 Last: 14.09.2026 10:06 Sources 1

About this happening: CISA added CVE-2026-85706 to its actively exploited catalog after GitLab CE/EE servers were probed and attacked, increasing the risk of credential and secret disclosure*...

Open Happening

GitLab CE/EE security update for CVE-2026-85706

Security Patch Release
H score44 First: 14.09.2026 10:06 Last: 14.09.2026 10:06 Sources 1

About this happening: GitLab released CE/EE fixes for CVE-2026-85706, and users were urged to patch immediately to close a repository commits API flaw that can expose credentials and se...

Open Happening

CISA KEV listing and BOD 26-04 remediation deadline for GitLab CVE-2026-85706

Public Sector Action
H score36 First: 14.09.2026 10:06 Last: 14.09.2026 10:06 Sources 1

About this happening: CISA added CVE-2026-85706 to its actively exploited catalog and gave federal agencies three days to secure affected systems under BOD 26-04. The move turns the...

Open Happening

GitLab CE/EE security patch release (CVE-2023-2825, CVE-2026-87719)

Security Patch Release
H score45 First: 11.09.2026 14:15 Last: 11.09.2026 14:15 Sources 1

How related: Also patched by GitLab in versions 19.3.2, 19.2.6, and 19.1.8 is a critical insecure deserialization bug in GitLab EE (CVE-2026-87719, CVSS score: 9.9) that could result in information disclosure.

About this happening: GitLab released fixes for CVE-2023-2825 and CVE-2026-87719 in GitLab Community Edition (CE) and Enterprise Edition (EE), requiring self-managed installations...

Open Happening

Timeline

  1. 11.09.2026 14:15 3 articles · 13d ago

    GitLab urges immediate upgrade of self-managed installations after patching two security issues

    Mitigation Patch Update

    GitLab released fixes for self-managed GitLab installations and urged operators to upgrade immediately to versions 19.3.2, 19.2.6, or 19.1. The patched issues include CVE-2023-2825, a maximum-severity path traversal flaw that can let unauthenticated attackers read arbitrary files under certain conditions, and CVE-2026-87719, a critical insecure deserialization weakness in the GraphQL subscription serializer that affects GitLab EE and can let authenticated users with Duo Chat access steal sensitive credentials and Advanced Search instance configurations. GitLab.com was already running the patched version, and GitLab Dedicated customers did not need to take action.

    Show sources
    Open in new tab