GitLab Critical Patch Release

GitLab

GitLab has released a critical patch update for several vulnerabilities, including remote code execution flaws.

First seen: 21 Oct 2026
Last update: 21 Oct 2026, 00:00 UTC
Fixed in: 19.5.1
19.4.3
19.3.6
19.2.9
19.1.9
19.0.10
18.11.13
Source: news
On the menu as: GitLab

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## GitLab Critical Patch Release
Severity: high. Patch status: patched.
Affected: GitLab
Fixed in: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13

GitLab has released a critical patch update for several vulnerabilities, including remote code execution flaws.

## Steps
1. This touches infrastructure (gitlab). Look in terraform, ansible, cloud-init, Dockerfiles and docs for the product and version we run. If it isn't in the repo, say so and list what a human should check on the box.

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/
https://pwned.coffee/i/gitlab-critical-patch-release

Sources

docs.gitlab.com: GitLab Critical Patch Release: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13

Totalone hot coffee