Critical Security Update: GitLab Patches Multiple Authorization and DoS Vulnerabilities
GitLab has released a series of urgent security patches—versions 19.0.1, 18.11.4, and 18.10.7—to remediate seven distinct vulnerabilities affecting both GitLab Community Edition (CE) and Enterprise Edition (EE). These flaws range from high-severity access control bypasses in Duo AI workflows to service-disrupting Denial of Service (DoS) vulnerabilities within the Wiki component.
For organizations running self-managed installations, an immediate upgrade is highly recommended to mitigate potential exploitation. Users of GitLab.com and GitLab Dedicated are already protected, as these environments have been patched automatically by the GitLab team.
Technical Breakdown of Vulnerabilities
The most critical finding is CVE-2026-4868, which carries a high CVSS score of 8.2. This vulnerability stems from improper user identity resolution within the Duo AI workflow runners. In an Enterprise Edition environment, an authenticated user could theoretically trigger AI workflows while masquerading as another user, effectively bypassing the principle of least privilege.
Beyond identity resolution, the patch addresses several authorization logic errors across the GraphQL API, Pipelines, and authentication endpoints. These flaws could allow lower-privileged users to access private project data or manipulate operations they are not authorized to perform.
| CVE ID | Description | Product Impact | Affected Versions | CVSS |
|---|---|---|---|---|
| CVE-2026-4868 | Improper Access Control (Duo AI) | GitLab EE | < 18.10.7, < 18.11.4, < 19.0.1 | 8.2 |
| CVE-2026-1402 | Wiki Denial of Service (DoS) | GitLab CE/EE | < 18.10.7, < 18.11.4, < 19.0.1 | 6.5 |
| CVE-2026-6713 | GraphQL WorkItem API Authorization | GitLab CE/EE | < 18.10.7, < 18.11.4, < 19.0.1 | 5.3 |
| CVE-2026-5296 | Duo Workflows API Authorization | GitLab EE | < 18.10.7, < 18.11.4, < 19.0.1 | 4.3 |
| CVE-2026-2601 | Operations Authorization Bypass | GitLab EE | < 18.10.7, < 18.11.4, < 19.0.1 | 4.3 |
| CVE-2026-8716 | Pipeline Name Resolution Flaw | GitLab CE/EE | < 18.10.7, < 18.11.4, < 19.0.1 | 4.3 |
| CVE-2026-2710 | Auth Endpoint Authorization | GitLab CE/EE | < 18.10.7, < 18.11.4, < 19.0.1 | 4.3 |
Deployment Guidance and Remediation
According to the official GitLab patch release notes, these updates do not introduce new database migrations. This is a significant advantage for DevOps teams, as it means multi-node deployments should be able to upgrade without scheduled downtime.
Recommended Action Plan for Security Teams:
- Patch Immediately: Transition all self-managed instances to the latest patched version of your current release branch.
- Audit Logs: Following the upgrade, perform a retrospective review of access logs. Specifically, look for anomalous activity in Duo AI workflows, unusual Wiki edits, or unauthorized CI/CD pipeline executions.
- Verify AI Permissions: For organizations heavily integrating AI into their SDLC, re-verify that user permissions in Duo Workflows are correctly enforcing strict isolation.
This release serves as a vital reminder of the expanding attack surface in modern DevOps platforms. As features like AI-driven automation and complex GraphQL APIs become core to the development lifecycle, securing the identity and authorization layers becomes increasingly critical.