Self-managed GitLab CE and EE administrators should update immediately. GitLab released a critical patch on August 17, 2026 that addresses CVE-2026-19478 and a related high-severity issue, CVE-2026-19650.
For CVE-2026-19478, GitLab says certain affected releases could allow an unauthenticated party to modify or delete public projects and user data. GitLab.com and GitLab Dedicated were already running patched versions when the release was announced; this guidance is for self-managed installations.
Install A Patched GitLab Release
Move to the supported patched release for your current major version:
- GitLab 19.2: update to 19.2.4 or later.
- GitLab 19.1: update to 19.1.6 or later.
- GitLab 19.0: update to 19.0.8 or later.
- GitLab 18.11: update to 18.11.11 or later.
What To Check Before Maintenance
- Identify every self-managed CE or EE instance, including standby and recovery environments.
- Confirm the active version and the supported update path with GitLab’s release documentation.
- Use the normal approved maintenance, backup, and rollback process for the service.
- Notify repository owners, CI users, and integration owners about the maintenance window.
Verify The Update
- Confirm the patched GitLab version is running after maintenance.
- Check normal sign-in, project access, repository operations, CI pipelines, integrations, and monitoring.
- Review routine security and service telemetry for unexpected changes around the maintenance window.
- Keep normal administrator access controls and public-project governance in place after the update.
Multi-Node And Hosting Environments
GitLab states this patch release includes no new migrations and that multi-node deployments should not require downtime. Still, use the vendor’s release notes and your documented change process for the specific topology, integrations, and maintenance controls in use. Do not turn an urgent patch into an unplanned platform redesign.
Related FixItPhill Guidance
For maintenance communication and service ownership, start with the FixItPhill support hub. Teams operating containerized workloads can also use the Docker security update guide as a planning reference, and administrators managing busy Linux hosts can review this Linux hosting maintenance checklist.