GitLab patches 15 security flaws in new CE and EE update

GitLab has released security updates for Community Edition and Enterprise Edition, fixing 15 vulnerabilities in versions 18.9.2, 18.8.6, and 18.7.6. The company says self-managed administrators should upgrade as soon as possible, while GitLab.com and GitLab Dedicated already run the patched code.

The most severe issue in this release is CVE-2026-1090, a high-severity cross-site scripting flaw with a CVSS score of 8.7. GitLab says the bug affects Markdown placeholder processing when the Markdown placeholders feature flag is enabled, and it could allow an authenticated attacker to inject malicious JavaScript into a victim’s browser.

The update also fixes several denial-of-service bugs, including three high-severity issues with CVSS 7.5 scores. GitLab says one affects the GraphQL API through uncontrolled recursion, another hits repository archive endpoints, and a third impacts the protected branches API through specially crafted JSON payloads.

This makes the March 2026 GitLab release important for both security and uptime. Some of the flaws can let attackers crash exposed services without authentication, while others could enable browser-based attacks or unauthorized data access under specific conditions.

What GitLab fixed

Source: GitLab patch release advisory.

Key details from the advisory

GitLab says CVE-2026-1090 affects all versions from 10.6 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2. The company credits the report to a HackerOne researcher and notes that the flaw only applies when the Markdown placeholders feature flag is enabled.

For the API and service availability bugs, GitLab says CVE-2026-1069 can allow an unauthenticated user to trigger denial of service with specially crafted GraphQL requests, CVE-2025-13929 can hit repository archive endpoints, and CVE-2025-14513 affects the protected branches API. All three carry the same 7.5 CVSS rating in GitLab’s bulletin.

The release also fixes several lower-severity issues beyond XSS and DoS. These include CRLF-related internal request risks in import functionality, improper access control in the runners API, metadata disclosure through snippet rendering, confidential issue title disclosure, and an authorization issue in GitLab EE’s Virtual Registry.

What admins should do now

• Upgrade self-managed GitLab CE or EE instances to 18.9.2, 18.8.6, or 18.7.6.
• Expect regular migrations during upgrades to 18.9.2 and 18.8.6.
• Use GitLab’s zero-downtime upgrade guidance for multi-node deployments.
• Use standard upgrade guidance for single-node installations, which may see brief downtime.
• No action is needed for GitLab.com and GitLab Dedicated users because GitLab says those services are already patched.

Why this release stands out

This is not just a minor maintenance update. GitLab bundled a relatively large set of fixes into one patch release, and the mix includes browser-side XSS, unauthenticated service disruption risks, and data exposure issues. For organizations that run self-managed GitLab as a core development platform, delays in patching could affect both security and developer productivity.

The advisory also shows how broad GitLab’s affected version ranges can be. Several flaws reach far back across many release lines, which means older self-managed deployments may remain exposed until admins install one of the patched versions.

FAQ