Ce mail provient de l'extérieur, restons vigilants ===================================================================== CERT-Renater Note d'Information No. 2026/VULN968 _____________________________________________________________________ DATE : 02/10/2026 HARDWARE PLATFORM(S): / OPERATING SYSTEM(S): Systems running GitLab versions prior to 19.0.9, 18.11.12. ==================================================================== https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-0-9-released/ _____________________________________________________________________ GitLab Critical Patch Release: 19.0.9, 18.11.12 On September 23, 2026, we released versions 19.0.9 and 18.11.12 for GitLab Community Edition (CE) and Enterprise Edition (EE). These versions backport the fixes for two critical vulnerabilities, CVE-2026-85706 and CVE-2026-87719, that were originally patched in 19.3.2, 19.2.6, and 19.1.8 on September 10, 2026. These backports were made available outside of our standard maintenance policy so that self-managed administrators running 18.11 and 19.0 can apply the fixes without first completing a version upgrade. These versions contain no other changes. We strongly recommend that all self-managed GitLab installations still running 18.11 or 19.0 be upgraded to one of these versions immediately. Installations running 19.1, 19.2, or 19.3 should upgrade to 19.1.8, 19.2.6, or 19.3.2 or later instead. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action. GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases: scheduled releases and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays. For more information, please visit our releases handbook and security FAQ. You can see all GitLab release blog posts. For security fixes, the issues detailing each vulnerability are made public on our issue tracker 90 days after the release in which they were patched. We are committed to ensuring that all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. To maintain good security hygiene, it is highly recommended that all customers upgrade to the latest patch release for their supported version. You can read more best practices in securing your GitLab instance in our blog post. Recommended Action We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible. When no specific deployment type (omnibus, source code, Helm chart, etc.) of a product is mentioned, it means all types are affected. Security fixes The fixes in these versions are the same fixes that were released in 19.1.8, 19.2.6, and 19.3.2 on September 10, 2026. Table of security fixes Title Severity Path Traversal issue in repository commits API impacts GitLab CE/EE Critical Insecure Deserialization issue in GraphQL subscription serializer impacts GitLab EE Critical CVE-2026-85706 - Path Traversal issue in repository commits API impacts GitLab CE/EE GitLab has remediated an issue that, under certain conditions, an unauthenticated user could have read arbitrary files from the GitLab server due to improper path confinement and missing authentication enforcement in the repository commits API. Impacted Versions: GitLab CE/EE: all versions from 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 CVSS 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) Thanks s3ntago for reporting this vulnerability through our HackerOne bug bounty program. Detecting CVE-2026-85706 Exploitation Attempts CVE-2026-85706 has been added to CISA’s Known Exploited Vulnerabilities catalog. GitLab-managed infrastructure, including GitLab.com and GitLab Dedicated, remains patched. GitLab security has released three threat detections to support customers with self-managed instances: GitLab LFI attempt reading gitlab.yml GitLab LFI via metadata.path parameter GitLab LFI file path attempt CVE-2026-87719 - Insecure Deserialization issue in GraphQL subscription serializer impacts GitLab EE GitLab has remediated an issue that, under certain conditions, could allow an authenticated user with Duo Chat access to obtain Advanced Search instance configurations and sensitive credentials using a specially crafted GraphQL subscription argument to bypass serialization and perform server object lookup. Impacted Versions: GitLab EE: all versions from 18.3 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 CVSS 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Thanks kyyblin for reporting this vulnerability through our HackerOne bug bounty program. Bug fixes These versions contain the security fixes listed above only. They do not contain any other bug fixes. Important notes on upgrading 19.0.9 and 18.11.12 are backport releases for self-managed installations that cannot immediately move to a supported 19.1 or later version. Upgrading to the latest supported version remains the recommended path, because 18.11 and 19.0 do not receive the other fixes included in 19.1.8, 19.2.6, and 19.3.2. To learn more about the impact of upgrades on your installation, see: Zero-downtime upgrades for multi-node deployments Standard upgrades for single-node installations Updating To update GitLab, see the Update page. To update GitLab Runner, see the Updating the Runner page. Receive Patch Notifications To receive patch blog notifications delivered to your inbox, visit our contact us page. To receive release notifications via RSS, subscribe to our patch release RSS feed or our RSS feed for all releases. ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 23/25 Rue Daviel | fax : 01-53-94-20-41 + + 75013 Paris | email:cert@support.renater.fr + =========================================================