GitLab Patch Release: 18.9.1, 18.8.5, 18.7.5

Laag (27/100) — reguliere patchcyclus. Bepalend: technische ernst (42/100) en gemeentelijke relevantie (30/100). Meelopen in de reguliere patch- en beheercyclus volstaat. Deze prioritering is regelgebaseerd en navolgbaar; weeg de aannames en onzekerheden mee voor de eigen gemeentelijke omgeving.

Deze prioritering is regelgebaseerd en navolgbaar. Een CISO kan deze onderbouwing gebruiken richting directie of ICT-management; stem de opvolging af op de eigen gemeentelijke omgeving.

De acties zijn regelgebaseerd gegenereerd. Stem ze af op de eigen gemeentelijke omgeving en wijs per actie een eigenaar en deadline toe.

// Defender-waarschuwingen rond endpointcompromittatie
SecurityAlert
| where TimeGenerated > ago(7d)
| where ProductName == "Microsoft Defender for Endpoint"
| where AlertSeverity in ("High", "Medium")
| project TimeGenerated, AlertName, AlertSeverity, CompromisedEntity,
    Description
| order by TimeGenerated desc

Deze informatie is uitsluitend defensief: detectie en hunting. De KQL-queries zijn read-only en bedoeld voor Microsoft Sentinel.

Geachte heer/mevrouw,

Naar aanleiding van een beveiligingsmelding met kenmerk CVE-2025-14103 doet onze gemeente een uitvraag bij u als leverancier. Deze uitvraag dient ter verificatie en feitenvaststelling: wij willen vaststellen of en in welke mate de aan onze gemeente geleverde dienstverlening wordt geraakt. Het betreft mogelijk het product of onderdeel "Containers".

Wij verzoeken u de onderstaande vragen volledig en onderbouwd te beantwoorden en uw reactie binnen tien (10) werkdagen na ontvangst van dit bericht schriftelijk aan te leveren bij de informatiebeveiligingsfunctie van onze gemeente. Zijn bepaalde gegevens nog niet beschikbaar, dan ontvangen wij graag een tussentijdse terugkoppeling.

Vragen:
1. Gebruikt u de kwetsbare component of het geraakte product?
2. Welke versies zijn bij u in gebruik?
3. Is de kwetsbaarheid van toepassing op de dienstverlening aan onze gemeente?
4. Is de kwetsbaarheid inmiddels gepatcht?
5. Zo ja, op welke datum is de patch doorgevoerd?
6. Zo nee, welke mitigerende maatregelen zijn genomen?
7. Is er actief misbruik van de kwetsbaarheid geconstateerd?
8. Is er logging of forensisch onderzoek uitgevoerd?
9. Is er sprake van een risico op een datalek?
10. Wanneer verwacht u een definitieve oplossing door te voeren?
11. Welke restrisico's blijven na de oplossing bestaan?
12. Welke communicatie mogen wij richting onze interne stakeholders gebruiken?

Deze uitvraag is bedoeld om de feiten vast te stellen en gezamenlijk tot een passende opvolging te komen. Wij stellen uw tijdige medewerking op prijs.

Met vriendelijke groet,

[Naam]
Namens de informatiebeveiligingsfunctie
Gemeente [Gemeente]

Vul vóór verzending de afzender en gemeentenaam in. De tekst is zakelijk en gericht op feitenvaststelling; pas hem aan op de eigen situatie.

Deze dreiging raakt de onderstaande governance-thema's. Met de aanbevolen bewijsstukken kunt u aantonen dat het signaal is opgevolgd — bruikbaar voor BIO2, NIS2/CBW, ISMS en de ENSIA-verantwoording.

On February 25, 2026, we released versions 18.9.1, 18.8.5, 18.7.5 for GitLab Community Edition (CE) and Enterprise Edition (EE). These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action. GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases: scheduled releases and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays. For more information, please visit our releases handbook and security FAQ . You can see all of GitLab release blog posts here . For security fixes, the issues detailing each vulnerability are made public on our issue tracker 30 days after the release in which they were patched. We are committed to ensuring that all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. To maintain good security hygiene, it is highly recommended that all customers upgrade to the latest patch release for their supported version. You can read more best practices in securing your GitLab instance in our blog post. Recommended Action We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible . When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, it means all types are affected. Security fixes Table of security fixes Title Severity Cross-site Scripting issue in Mermaid sandbox impacts GitLab CE/EE High Denial of Service issue in container registry impacts GitLab CE/EE High Denial of Service issue in Jira events endpoint impacts GitLab CE/EE High Regular Expression Denial of Service issue in GitLab merge requests impacts GitLab CE/EE High Missing rate limit in Bitbucket Server importer impacts GitLab CE/EE Medium Denial of Service issue in CI trigger API impacts GitLab CE/EE Medium Denial of Service issue in token decoder impacts GitLab CE/EE Medium Improper Access Control issue in Conan package registry impacts GitLab EE Medium Access Control issue in CI job mutation impacts GitLab CE/EE Medium CVE-2026-0752 - Cross-site Scripting issue in Mermaid sandbox impacts GitLab CE/EE GitLab has remediated an issue that under certain circumstances, could have allowed an unauthenticated user to inject arbitrary scripts into the Mermaid sandbox UI. Impacted Versions: GitLab CE/EE: all versions from 16.2 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 CVSS 8.0 ( CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N ) Thanks aphantom for reporting this vulnerability through our HackerOne bug bounty program CVE-2025-14511 - Denial of Service issue in container registry impacts GitLab CE/EE GitLab has remediated an issue that could have allowed an unauthenticated user to cause denial of service by sending specially crafted files to the container registry event endpoint under certain conditions. Impacted Versions: GitLab CE/EE: all versions from 12.2 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 CVSS 7.5 ( CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H ) Thanks a92847865 for reporting this vulnerability through our HackerOne bug bounty program CVE-2026-1662 - Denial of Service issue in Jira events endpoint impacts GitLab CE/EE GitLab has remediated an issue that could have allowed an unauthenticated user to cause Denial of Service by sending specially crafted requests to the Jira events endpoint. Impacted Versions: GitLab CE/EE: all versions from 14.4 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 CVSS 7.5 ( CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H ) Thanks a92847865 for reporting this vulnerability through our HackerOne bug bounty program CVE-2026-1388 - Regular Expression Denial of Service issue in GitLab merge requests impacts GitLab CE/EE GitLab has remediated an issue that could have allowed an unauthenticated user to cause regular expression denial of service by sending specially crafted input to a merge request endpoint under certain conditions. Impacted Versions: GitLab CE/EE: all versions from 9.2 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 CVSS 7.5 ( CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H ) Thanks sim4n6 for reporting this vulnerability through our HackerOne bug bounty program CVE-2026-2845 - Missing rate limit in Bitbucket Server importer impacts GitLab CE/EE GitLab has remediated an issue that could have allowed an authenticated user to cause denial of service by exploiting a Bitbucket Server import endpoint via repeatedly sending large responses. Impacted Versions: GitLab CE/EE: all versions from 11.2 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 CVSS 6.5 ( CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H ) This vulnerability has been discovered internally by GitLab team member Sam Word CVE-2025-3525 - Denial of Service issue in CI trigger API impacts GitLab CE/EE GitLab has remediated an issue that could have, under certain circumstances, allowed an authenticated user with certain access to cause denial of service by creating specially crafted CI triggers via the API. Impacted Versions: GitLab CE/EE: all versions from 9.0 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 CVSS 6.5 ( CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H ) Thanks pwnie for reporting this vulnerability through our HackerOne bug bounty program CVE-2026-1725 - Denial of Service issue in token decoder impacts GitLab CE/EE GitLab has remediated an issue that could have under certain conditions, allowed an unauthenticated user to cause denial of service by sending specially crafted requests to a CI jobs API endpoint. Impacted Versions: GitLab CE/EE: versions from 18.9 before 18.9.1 CVSS 5.3 ( CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L ) Thanks vinax for reporting this vulnerability through our HackerOne bug bounty program CVE-2026-1747 - Improper Access Control issue in Conan package registry impacts GitLab EE GitLab has remediated an issue that, under certain conditions, could have allowed Developer-role users with insufficient privileges to make unauthorized modifications to protected Conan packages. Impacted Versions: GitLab EE: all versions from 17.11 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 CVSS 4.3 ( CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N ) Thanks modhanami for reporting this vulnerability through our HackerOne bug bounty program CVE-2025-14103 - Access Control issue in CI job mutation impacts GitLab CE/EE GitLab has remediated an issue that could have allowed an unauthorized user with Developer-role permissions to set pipeline variables for manually triggered jobs under certain conditions. Impacted Versions: GitLab CE/EE: all versions from 17.7 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 CVSS 4.3 ( CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N ) Thanks go7f0 for reporting this vulnerability through our HackerOne bug bounty program Bug fixes 18.9.1 Backport of fix semantic code search for Premium plans Backport of “Implement usage of namespace AI data collection setting” Backport of AI data collection docs Backport of “Add exclude_types to the get_agent_flows query” Backport of “Bypass group membership lock for service accounts” Backport 18.9 - CI - Token used for release environments [Backport] Zoekt Fix the bug of includeForked Backport of Fix adding flows when member invites are disabled Backport of Fix workspace PAT creation with short PAT lifetime Backport of Remove API dependency on composite identity onboarding 18.8.5 Disable gitlab credits dashboard page for SM trial Backport: Workhorse: Ignore misconfigured redis for DWS locking Backport of skip rebase check for detailed merge status Backport of ‘Time to first byte degradation on list merge requests API’ Backport of Update gitlab-cloud-connector gem to 1.44 Backport - Remove orphaned zoektCrossNamespaceSearch feature flag reference Move bot avatar assets to app/assets for proper asset pipeline inclusion Backport of ‘Geo Primary Verification: Check actual verification state when checksumming’ Backport of Fix introspection query Backport PG::UntranslatableCharacter fixes for MoveCiBuildsMetadata background migration Backport optimizing of the MergeRequestResetApprovals Worker Backport of ‘Remove unused retag-gdk-image CI job’ Backport of “Docs: Added support for Credits and DAP from 18.8 and later” Backport of ‘Enable the disable_all_mentions FF by default ‘ Backport of Validate milestone title for group import Backport of workhorse: Return 400 from /cable without valid websocket upgrade Skip Feature.enabled? override in test environment - 18.8 [Backport] Zoekt Fix the bug of includeForked Backport of “Bypass group membership lock for service accounts” Backport of Fix adding flows when member invites are disabled Backport of Reset group_push_rules primary key sequence Backport of Fix workspace PAT creation with short PAT lifetime Backport Use new auth in advanced wiki search 18.7.5 Backport of ‘Fix Zoekt indexing by cleaning up replicas without indices’ Backport of ‘Time to first byte degradation on list merge requests API’ Backport of Validate milestone title for group import Backport of ‘Remove unused retag-gdk-image CI job’ Backport of workhorse: Return 400 from /cable without valid websocket upgrade Backport of Reset group_push_rules primary key sequence Backport Use new auth in advanced wiki search Important notes on upgrading The SLES 12.5 package is not available for GitLab 18.9.1. This patch includes database migrations that may impact your upgrade process. Impact on your installation: Single-node instances : This patch will cause downtime during the upgrade as migrations must complete before GitLab can start. Multi-node instances : With proper zero-downtime upgrade procedures , this patch can be applied without downtime. Post-deploy migrations The following versions include post-deploy migrations that can run after the upgrade: 18.8.5 To learn more about the impact of upgrades on your installation, see: Zero-downtime upgrades for multi-node deployments Standard upgrades for single-node installations Updating To update GitLab, see the Update page . To update GitLab Runner, see the Updating the Runner page . Receive Patch Notifications To receive patch blog notifications delivered to your inbox, visit our contact us page. To receive release notifications via RSS, subscribe to our patch release RSS feed or our RSS feed for all releases .