Vulnerabilities · 49 days ago
On Sept. 24, CSIRT Italia joined INCIBE-CERT in confirming 11 vulnerabilities in GitLab Community and Enterprise editions, including two critical and two high-severity flaws. Affected self-managed versions range from 13.11 to releases before 19.2.7, 19.3.3, or 19.4.1; those versions contain the fixes. The update adds no new exploitation evidence or change in affected scope.
Both critical flaws involve regular expressions in CI/CD configuration. An authenticated user can place a specially crafted pattern in pipeline settings; a memory-handling error or a number overflow while GitLab processes the pattern can make it run code on the server instead of simply evaluating it. Other flaws in the batch could expose confidential information or bypass security controls.
For self-managed teams, CI/CD configuration is part of the server’s execution boundary, not just build metadata. GitLab says its Dedicated service already runs a fixed version, leaving the update exposure with customer-operated CE/EE.
CVEs in this update
10 CVEs
Across GitLab.
2 critical · 2 high · 5 medium · 1 low
0 in CISA KEV · 0 with EPSS above 1%
Highest severity: CVE-2026-89078 · 9.9 CRITICAL
Highest EPSS: CVE-2026-84739 · 0.34%
2 sources covering this story
Risolte vulnerabilità su GitLab CE/EE
Rilasciati aggiornamenti di sicurezza che risolvono 11 vulnerabilità, di cui 2 con gravità “critica” e 2 con gravità “alta”, in GitLab Community Edition (CE) ed Enterprise Edition (EE).
Múltiples vulnerabilidades en GitLab
Los investigadores joaxcar, ahacker1, rogerace y scyoon, junto con varios miembros del equipo de GitLa
Part of the PlainSec briefing for 2026-09-24