GitLab: security fixes

GitLab

GitLab released versions 19.5.4, 19.4.6, 19.3.8 with security fixes

Do this now

Check GitLab's advisory for a fix and restrict access to affected instances meanwhile.

Who should check: teams running GitLab

First seen: 10 Nov 2026
Last update: 10 Nov 2026, 22:18 UTC
Versions per the CVE record from GitLab, not the vendor: 2.56.1
2.55.1
2.54.1
2.53.1
2.52.1
2.51.3
2.50.2
2.49.1
Identifiers: CVE-2026-105437
CVSS: 7.5
Source: news
On the menu as: GitLab

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## GitLab: security fixes
Severity: high. Patch status: fix status unknown.
Affected: GitLab
Versions per the CVE record from GitLab, not the vendor: 2.56.1, 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3, 2.50.2, 2.49.1
Ids: CVE-2026-105437

GitLab released versions 19.5.4, 19.4.6, 19.3.8 with security fixes

## Steps
1. This touches infrastructure (gitlab). Look in terraform, ansible, cloud-init, Dockerfiles and docs for the product and version we run. If it isn't in the repo, say so and list what a human should check on the box.
2. Versions per the CVE record from GitLab, not the vendor: Git: 2.56.x → 2.56.1; 2.55.x → 2.55.1; 2.54.x → 2.54.1; 2.53.x → 2.53.1; 2.52.x → 2.52.1; 2.51.x → 2.51.3; 2.50.x → 2.50.2; 2.49.1. Don't treat them as a fix until the vendor says so.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| Git 2.56.x | per the CVE record from GitLab, not the vendor | 2.56.1 | restrict network access to it |
| Git 2.55.x | per the CVE record from GitLab, not the vendor | 2.55.1 | restrict network access to it |
| Git 2.54.x | per the CVE record from GitLab, not the vendor | 2.54.1 | restrict network access to it |
| Git 2.53.x | per the CVE record from GitLab, not the vendor | 2.53.1 | restrict network access to it |
| Git 2.52.x | per the CVE record from GitLab, not the vendor | 2.52.1 | restrict network access to it |
| Git 2.51.x | per the CVE record from GitLab, not the vendor | 2.51.3 | restrict network access to it |
| Git 2.50.x | per the CVE record from GitLab, not the vendor | 2.50.2 | restrict network access to it |
| Git | per the CVE record from GitLab, not the vendor | 2.49.1 | restrict network access to it |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-105437") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-4-released/
https://pwned.coffee/i/gitlab-security-fixes

Timeline

10 Nov 2026, 22:18 UTC
Fix status: patched → unknown.
10 Nov 2026
First reported.

Receipt

Exploitation: No known exploitation
By release line, per the CVE record from GitLab, not the vendor: Product Affected Version named Source
Git 2.56.0-rc0 to before 2.56.1 2.56.1 CVE record (CNA) per the CVE record from GitLab, not the vendor checked 12 Nov
Git 2.55.0-rc0 to before 2.55.1 2.55.1 CVE record (CNA) per the CVE record from GitLab, not the vendor checked 12 Nov
Git 2.54.0-rc0 to before 2.54.1 2.54.1 CVE record (CNA) per the CVE record from GitLab, not the vendor checked 12 Nov
Git 2.53.0-rc0 to before 2.53.1 2.53.1 CVE record (CNA) per the CVE record from GitLab, not the vendor checked 12 Nov
Git 2.52.0-rc0 to before 2.52.1 2.52.1 CVE record (CNA) per the CVE record from GitLab, not the vendor checked 12 Nov
Git 2.51.0-rc0 to before 2.51.3 2.51.3 CVE record (CNA) per the CVE record from GitLab, not the vendor checked 12 Nov
Git 2.50.0-rc0 to before 2.50.2 2.50.2 CVE record (CNA) per the CVE record from GitLab, not the vendor checked 12 Nov
Git before 2.49.1 2.49.1 CVE record (CNA) per the CVE record from GitLab, not the vendor checked 12 Nov
Score: CVSS 7.5 (high). CVSS 3.1 7.5 (CNA GitLab) for CVE-2026-105437
Last checked: 13 Nov 2026, 16:26 UTC

Product	Affected	Version named	Source
Git	2.56.0-rc0 to before 2.56.1	2.56.1	CVE record (CNA) per the CVE record from GitLab, not the vendor checked 12 Nov
Git	2.55.0-rc0 to before 2.55.1	2.55.1	CVE record (CNA) per the CVE record from GitLab, not the vendor checked 12 Nov
Git	2.54.0-rc0 to before 2.54.1	2.54.1	CVE record (CNA) per the CVE record from GitLab, not the vendor checked 12 Nov
Git	2.53.0-rc0 to before 2.53.1	2.53.1	CVE record (CNA) per the CVE record from GitLab, not the vendor checked 12 Nov
Git	2.52.0-rc0 to before 2.52.1	2.52.1	CVE record (CNA) per the CVE record from GitLab, not the vendor checked 12 Nov
Git	2.51.0-rc0 to before 2.51.3	2.51.3	CVE record (CNA) per the CVE record from GitLab, not the vendor checked 12 Nov
Git	2.50.0-rc0 to before 2.50.2	2.50.2	CVE record (CNA) per the CVE record from GitLab, not the vendor checked 12 Nov
Git	before 2.49.1	2.49.1	CVE record (CNA) per the CVE record from GitLab, not the vendor checked 12 Nov

Sources: KEV – CVE record ✓ Vendor –

Sources

docs.gitlab.com: GitLab Critical Patch Release: 19.5.4, 19.4.6, 19.3.8

Follow on X

Totalone hot coffee