GitLab has released security updates for both Community Edition (CE) and Enterprise Edition (EE) to address multiple vulnerabilities, including two critical flaws that could expose sensitive information and a high-severity vulnerability that may lead to remote code execution. The most severe issue, CVE-2026-85706, is a path traversal vulnerability in the repository commits API with a CVSS score of high. Under certain conditions, an unauthenticated attacker could exploit crafted path traversal sequences to read arbitrary files outside the intended repository directory. Depending on the server configuration and permissions of the GitLab process, exposed information could include application configuration files, secrets, access tokens, SSH keys, and database credentials.

GitLab also addressed CVE-2026-87719, a critical insecure deserialization vulnerability in the GraphQL subscription serializer affecting Enterprise Edition. The flaw carries a CVSS score of high and requires an authenticated user with Duo Chat access. By submitting specially crafted GraphQL subscription arguments, an attacker could bypass serialization controls and trigger server-side object lookup, potentially exposing Advanced Search instance configurations and sensitive credentials. CVE-2026-85706 affects GitLab CE and EE versions 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2, while CVE-2026-87719 affects GitLab EE versions 18.3 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2.

Another significant vulnerability, CVE-2026-88765, is an high-CVSS buffer overflow in the GitLab EE Unicode conversion wrapper. An authenticated attacker could potentially achieve remote code execution by importing a specially crafted Git project export. The vulnerability occurs during Advanced Search indexing, making deployments that allow project imports particularly important to secure. GitLab also fixed several high-severity issues involving protected CI/CD variables, Markdown rendering, CI/CD environment variable access, and GraphQL resource handling, which could allow lower-privileged users to obtain protected variables, perform unintended state-changing requests, or trigger denial-of-service conditions.

GitLab released patched versions 19.3.2, 19.2.6, and 19.1.8 on September 10, 2026, and strongly recommends that all self-managed customers upgrade immediately according to their supported release branch. GitLab.com is already running the patched release, while GitLab Dedicated customers do not require action. Administrators should also consider the deployment impact because the update includes database migrations; single-node installations may experience downtime until migrations are completed, whereas properly configured multi-node environments can use GitLab's zero-downtime upgrade procedure.