On 12 October 2026, GitLab shipped 19.4.2, 19.3.5 and 19.2.8 to fix CVE-2026-97229, an integer overflow in the CI/CD regular expression compiler that allows unauthenticated remote code execution. If you self-host GitLab, upgrade now and treat your .gitlab-ci.yml files as code, not configuration.
On October 12, 2026, GitLab shipped a critical patch closing 24 flaws, including CVE-2026-97229, a CVSS 10.0 integer overflow in the CI/CD regular-expression compiler that is exploitable without authentication. Every operator of a self-managed instance should move to 19.4.2, 19.3.5 or 19.2.8 immediately, because this one no longer even asks for an account.
Starting October 19, 2026, GitLab.com caps requests by subscription — 60 per hour per anonymous IP, 5,000/hour on Free, up to 25,000/hour on Ultimate — to absorb load from AI agents and automation. Authenticate your scripts and agents, and check your peaks before the October 7 and 14 brownout windows.
On October 2, GitLab fixed a critical vulnerability (CVE-2026-90970, CVSS 9.9) that lets a logged-in user execute commands on the AI Gateway, the service that connects a GitLab instance to AI models. Only organizations that host their own gateway need to act: move to 19.2.4, 19.3.2 or 19.4.1 now.
On September 23, 2026, GitLab released a critical patch for 19.4.1, 19.3.3, and 19.2.7, closing two remote code execution flaws at CVSS 9.9 in the pipeline’s regular-expression parser, triggerable by a forged .gitlab-ci.yml file. Any authenticated user who can edit a CI/CD configuration becomes a vector: patch self-managed instances immediately.
On September 24, 2026, Aikido revealed that GitLab’s “Email work item to this project” addresses, generated with a long-lived token and accidentally published in READMEs, let an attacker open merge requests or push code as the token owner. Search your repositories for these addresses and reset the exposed tokens.
Released September 17, 2026, GitLab 19.4 governs MCP server tools, restricts their access, and hands agents pipeline control through save_pipeline and get_job. For teams deploying AI agents in the enterprise, the DevSecOps control plane becomes the governance layer.
On September 11, 2026, GitLab shipped an out-of-band release for CVE-2026-85706, a CVSS 10 path traversal that reads server files with no authentication via the commits API. The flaw is already being probed in the wild — patch self-managed instances before an attacker reads secrets.yml.
GitLab shipped versions 19.3.2, 19.2.6 and 19.1.8 on September 10, 2026 to fix eighteen flaws, including an unauthenticated arbitrary file read through the commits API and an insecure deserialization scored CVSS 9.9. Every exposed self-managed instance must be updated without delay, and protected CI/CD variable secrets need a review.
On August 26, 2026, GitLab shipped a fix for CVE-2026-18252, a flaw in the Duo Claude AI agent that lets an authenticated developer execute arbitrary commands in a CI context through user-controlled configuration. The lesson goes beyond GitLab: an AI agent wired into CI is a new execution surface, and the configuration it consumes is now part of the security boundary.
On August 18, 2026, GitLab released fixes for two vulnerabilities, including a critical code injection via a GraphQL directive (CVE-2026-19478, CVSS 9.4) exploitable remotely without authentication or user interaction, allowing attackers to modify or delete public projects. Every self-managed installation must upgrade immediately — GitLab.com and GitLab Dedicated are already patched.
GitLab extends its OpenBao-powered Secrets Manager to the External Secrets Operator, Terraform, and a direct API, beyond CI/CD alone. The pitch: replace scattered secret stores across CI/CD, Kubernetes, and IaC with a single audited source of truth.
GitLab 19.0 shipped on May 21, 2026 with a native Secrets Manager, AI-driven merge requests, and an SBOM scanner. The platform closes the gap between writing code and shipping it securely — a gap GitHub Copilot still leaves open.
