GitLab Patch Release: 19.3.1, 19.2.5, 19.1.7

Monitoren (36/100) — monitoren. Bepalend: gemeentelijke relevantie (77/100) en handelingsurgentie (33/100). Houd dit in de gaten; directe actie is nu niet nodig. Deze prioritering is regelgebaseerd en navolgbaar; weeg de aannames en onzekerheden mee voor de eigen gemeentelijke omgeving.

Deze prioritering is regelgebaseerd en navolgbaar. Een CISO kan deze onderbouwing gebruiken richting directie of ICT-management; stem de opvolging af op de eigen gemeentelijke omgeving.

De acties zijn regelgebaseerd gegenereerd. Stem ze af op de eigen gemeentelijke omgeving en wijs per actie een eigenaar en deadline toe.

// Defender-waarschuwingen rond endpointcompromittatie
SecurityAlert
| where TimeGenerated > ago(7d)
| where ProductName == "Microsoft Defender for Endpoint"
| where AlertSeverity in ("High", "Medium")
| project TimeGenerated, AlertName, AlertSeverity, CompromisedEntity,
    Description
| order by TimeGenerated desc

Deze informatie is uitsluitend defensief: detectie en hunting. De KQL-queries zijn read-only en bedoeld voor Microsoft Sentinel.

Geachte heer/mevrouw,

Naar aanleiding van een beveiligingsmelding met kenmerk CVE-2025-10903 doet onze gemeente een uitvraag bij u als leverancier. Deze uitvraag dient ter verificatie en feitenvaststelling: wij willen vaststellen of en in welke mate de aan onze gemeente geleverde dienstverlening wordt geraakt. Het exacte product of onderdeel is bij ons nog niet vastgesteld; wij vernemen dit graag van u.

Wij verzoeken u de onderstaande vragen volledig en onderbouwd te beantwoorden en uw reactie binnen tien (10) werkdagen na ontvangst van dit bericht schriftelijk aan te leveren bij de informatiebeveiligingsfunctie van onze gemeente. Zijn bepaalde gegevens nog niet beschikbaar, dan ontvangen wij graag een tussentijdse terugkoppeling.

Vragen:
1. Gebruikt u de kwetsbare component of het geraakte product?
2. Welke versies zijn bij u in gebruik?
3. Is de kwetsbaarheid van toepassing op de dienstverlening aan onze gemeente?
4. Is de kwetsbaarheid inmiddels gepatcht?
5. Zo ja, op welke datum is de patch doorgevoerd?
6. Zo nee, welke mitigerende maatregelen zijn genomen?
7. Is er actief misbruik van de kwetsbaarheid geconstateerd?
8. Is er logging of forensisch onderzoek uitgevoerd?
9. Is er sprake van een risico op een datalek?
10. Wanneer verwacht u een definitieve oplossing door te voeren?
11. Welke restrisico's blijven na de oplossing bestaan?
12. Welke communicatie mogen wij richting onze interne stakeholders gebruiken?

Deze uitvraag is bedoeld om de feiten vast te stellen en gezamenlijk tot een passende opvolging te komen. Wij stellen uw tijdige medewerking op prijs.

Met vriendelijke groet,

[Naam]
Namens de informatiebeveiligingsfunctie
Gemeente [Gemeente]

Vul vóór verzending de afzender en gemeentenaam in. De tekst is zakelijk en gericht op feitenvaststelling; pas hem aan op de eigen situatie.

Deze dreiging raakt de onderstaande governance-thema's. Met de aanbevolen bewijsstukken kunt u aantonen dat het signaal is opgevolgd — bruikbaar voor BIO2, NIS2/CBW, ISMS en de ENSIA-verantwoording.

On August 26, 2026, we released versions 19.3.1, 19.2.5, 19.1.7 for GitLab Community Edition (CE) and Enterprise Edition (EE). These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action. GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases: scheduled releases and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays. For more information, please visit our releases handbook and security FAQ . You can see all of GitLab release blog posts here . For security fixes, the issues detailing each vulnerability are made public on our issue tracker 90 days after the release in which they were patched. We are committed to ensuring that all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. To maintain good security hygiene, it is highly recommended that all customers upgrade to the latest patch release for their supported version. You can read more best practices in securing your GitLab instance in our blog post. Recommended Action We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible . When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, it means all types are affected. Security fixes Table of security fixes Title Severity Inclusion of Functionality from Untrusted Control Sphere issue in Duo Claude AI agent impacts GitLab EE High Denial of Service issue in import pipeline impacts GitLab CE/EE Medium Denial of Service issue in SCIM API impacts GitLab EE Medium Improper Access Control issue in protected environments impacts GitLab EE Medium Authorization Bypass issue in compliance framework assignment impacts GitLab EE Medium Improper Handling of Untrusted Data issue in Pipeline Execution Policies impacts GitLab EE Medium Improper Authorization issue in merge request approval rules reset impacts GitLab EE Low CVE-2026-18252 - Inclusion of Functionality from Untrusted Control Sphere issue in Duo Claude AI agent impacts GitLab EE GitLab has remediated an issue that, under certain conditions, an authenticated user with developer-role permissions could have executed arbitrary commands in a CI context, due to the Claude agent processing configuration from a user-controlled source. Impacted Versions: GitLab EE: all versions from 18.9 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 CVSS 7.3 ( CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N ) Thanks thwin_htet for reporting this vulnerability through our HackerOne bug bounty program CVE-2026-77801 - Denial of Service issue in import pipeline impacts GitLab CE/EE GitLab has remediated an issue that, under certain conditions, an authenticated user could have caused denial of service affecting background job processing, due to missing object count limits. Impacted Versions: GitLab CE/EE: all versions from 12.8 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 CVSS 6.5 ( CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H ) Thanks Tran Ba Quang for reporting this vulnerability CVE-2025-10903 - Denial of Service issue in SCIM API impacts GitLab EE GitLab has remediated an issue that, under certain conditions, an authenticated user could have caused denial of service, due to an unbounded loop triggered by specially crafted input in the SCIM user provisioning feature. Impacted Versions: GitLab EE: all versions from 11.10 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 CVSS 6.5 ( CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H ) Thanks rafabd1 for reporting this vulnerability through our HackerOne bug bounty program CVE-2026-3035 - Improper Access Control issue in protected environments impacts GitLab EE GitLab has remediated an issue that, under certain conditions, an authenticated user with project Maintainer permissions could have accessed the terminal of a protected environment they were not authorized to use due to improper authorization checks. Impacted Versions: GitLab EE: all versions from 11.3 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 CVSS 5.5 ( CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N ) Thanks go7f0 for reporting this vulnerability through our HackerOne bug bounty program CVE-2026-4398 - Authorization Bypass issue in compliance framework assignment impacts GitLab EE GitLab has remediated an issue that, under certain conditions, an authenticated user could have assigned compliance frameworks from namespaces they were not authorized to access to their own project, due to missing namespace validation on self-managed instances. Impacted Versions: GitLab EE: all versions from 18.3 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 CVSS 5.4 ( CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N ) Thanks bountyyfi for reporting this vulnerability through our HackerOne bug bounty program CVE-2026-15387 - Improper Handling of Untrusted Data issue in Pipeline Execution Policies impacts GitLab EE GitLab has remediated an issue that, under certain conditions, an authenticated user with developer-role permissions could have influenced the execution environment of Pipeline Execution Policy enforcement jobs, due to improper handling of job dependencies. Impacted Versions: GitLab EE: all versions from 19.1 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 CVSS 4.3 ( CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N ) Thanks 3nvz for reporting this vulnerability through our HackerOne bug bounty program CVE-2026-7487 - Improper Authorization issue in merge request approval rules reset impacts GitLab EE GitLab has remediated an issue that, under certain conditions, an authenticated user with reporter-role permissions who authored a merge request could have reset merge request approval rules due to improper authorization checks. Impacted Versions: GitLab EE: all versions from 13.1 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 CVSS 3.5 ( CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N ) Thanks rogerace for reporting this vulnerability through our HackerOne bug bounty program Bug fixes 19.3.1 Backport ‘Provision inherited foundational flows without user elevation’ to 19-3-stable-ee Backport 19.3 release notes to 19-3-stable-ee Backport of “Fix MCP OAuth Protected Resource Metadata resource field to return string instead of array” Backport of “Gate tracked ref filter on advanced vulnerability management” Backport of ‘Reorder deployments bigint cleanup so the FK sorts first’ Backport of 19.3 release note correction - redesigned agentic chat UI release post 19.2.5 Backport of ‘Fix broken master by making tests date-independent’ Backport of: Install glab from official GitLab releases instead of third-party mirror Backport of ‘Add import_jobs_concurrency_limit to application settings’ Backport of Fix infinite loop parsing errored SARIF security reports (19.2) Backport of ‘Preserve email reply content after lone bullet lines’ Release post backport: Add dedicated-hosted-ai-gateway release note to 19-2-stable-ee Backport: Add dedicated_self_hosted_models.md to 19.2 Backport of “Fix MCP OAuth Protected Resource Metadata resource field to return string instead of array” Backport of ‘Fix order-dependent epic import gap’ Backport of Fix drop_ai_* tables migrations Backport of “Send Duo availability params only when changed” (19.2) [19.2] Backport fixes for Mattermost deprecation Bump gitlab-omnibus-builder version to 5.63.1 19.1.7 Backport of: Install glab from official GitLab releases instead of third-party mirror Backport of ‘Add import_jobs_concurrency_limit to application settings’ Backport of Fix infinite loop parsing errored SARIF security reports (19.1) Backport of ‘Preserve email reply content after lone bullet lines’ Backport of ‘Avoid unbounded preload in any_merge_request rules sync’ Backport of “Send Duo availability params only when changed” (19.1) [19.1] Backport fixes for Mattermost deprecation Important notes on upgrading This patch includes database migrations that may impact your upgrade process. Impact on your installation: Single-node instances : This patch will cause downtime during the upgrade as migrations must complete before GitLab can start. Multi-node instances : With proper zero-downtime upgrade procedures , this patch can be applied without downtime. Regular migrations The following versions include regular migrations that run during the upgrade process: 19.3.1 19.2.5 19.1.7 Post-deploy migrations The following versions include post-deploy migrations that can run after the upgrade: 19.3.1 19.2.5 To learn more about the impact of upgrades on your installation, see: Zero-downtime upgrades for multi-node deployments Standard upgrades for single-node installations Updating To update GitLab, see the Update page . To update GitLab Runner, see the Updating the Runner page . Receive Patch Notifications To receive patch blog notifications delivered to your inbox, visit our contact us page. To receive release notifications via RSS, subscribe to our patch release RSS feed or our RSS feed for all releases .