GitLab bug can crash services

Published July 30, 2026

GitLab, the platform companies use to store code and run automated builds, had 13 security bugs. The worst ones could let a logged-in user see data they should not, tamper with automated build pipelines, or knock a server offline.

Report priority
Medium
Victim
GitLab

What is known

The most serious flaw is inside Workhorse, the internal component that handles file and request traffic for GitLab, which did not check permissions strictly enough, letting a user with basic Developer-level access reach information they should not see.

What to do

Check your installed GitLab version in the admin area or with gitlab-rake gitlab:env:info and compare it against 19.2.1, 19.1.3, or 19.0.5 on your release track. Update self-managed CE or EE instances to one of those patched versions now; GitLab.com is already patched and GitLab Dedicated customers do not need to do anything.

Update GitLab to version 19.2.1, 19.1.3, or 19.0.5 immediately via the built-in updater or your system's package manager.

Reported details

Thirteen CVEs were fixed, three rated high severity. CVE-2026-6267 (CVSS 8.5) is an access control gap in Workhorse letting a Developer-role user reach unauthorized data. CVE-2026-12436 (8.4) lets an authenticated attacker alter another user's Pipeline Schedule API configuration through improper attribute validation, risking CI/CD tampering.

CVE-2026-15975 (7.5) is an unauthenticated DoS in merge request discussions from insufficient resource throttling. CVE-2026-13113 (6.5, EE only) is a race condition in merge request approval rule processing that can let code merge into a protected branch without required approvals. Two GitLab Duo AI features were also patched: a prompt-injection issue in Duo Code Review (CVE-2026-15077) and a token-generation flaw letting Duo Workflows bypass admin governance policies (CVE-2026-15831).

References

View Original Source