GitLab said on October 12, 2026 that it shipped patch releases 19.4.2, 19.3.4 and 19.2.8 for its Community and Enterprise editions. One fix covers a flaw with the top CVSS score, 10.0. GitLab said that, under certain conditions, a person with no account could run any code they chose on the GitLab server. The route was a regular expression, a text-matching pattern, placed in a CI/CD setup file. GitLab said the pattern was not checked well enough. It urged self-managed users to upgrade right away. GitLab.com already runs the patch, and Dedicated customers need no action.
A researcher using the handle joaxcar reported the flaw through GitLab's HackerOne bug bounty program. Anything older than 19.2.8 on the 19.2 line, 19.3.4 on 19.3, or 19.4.2 on 19.4 is affected. The notice does not say whether anyone has attacked with it, and it gives no exploit steps. GitLab makes each issue public 90 days after its fix. The release also adds Ruby regexp patches for Ruby 3.3 and 3.4: one for program size and one for a double-free, a memory-handling bug. GitLab warns that 19.3.4 has a bug on merge request pages when the Ona integration is on.
Teams write CI/CD files themselves, yet the server reads them. Here that input reached a part of the system that could run code. Leaders should ask which GitLab instances are self-managed, who owns their upgrades, and whether outsiders can reach them. GitLab also warns that this patch includes database migrations that may affect the upgrade, so plan the window.