# GitLab patches multiple vulnerabilities in 19.5.1

Published: 2026-10-22 · Severity: routine · Sectors: Technology
Canonical: https://vorant.io/reports/567f0014-30d4-508d-91e6-020e2ac172c8/gitlab-patches-multiple-vulnerabilities-in-19-5-1

> CERT-FR warns of multiple GitLab CE/EE vulnerabilities allowing remote code execution, data exposure, and security bypass; patches available.

CERT-FR issued an advisory covering multiple vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE). The flaws affect versions 19.4.x prior to 19.4.3, 19.5.x prior to 19.5.1, and all versions prior to 19.3.6. Some of the vulnerabilities allow an attacker to achieve remote code execution, compromise data confidentiality, bypass security policies, or cause denial of service.

Twelve CVEs are referenced in this advisory (CVE-2026-103515, CVE-2026-105711, CVE-2026-105777, CVE-2026-110264, CVE-2026-112212, CVE-2026-112326, CVE-2026-112378, CVE-2026-12664, CVE-2026-13319, CVE-2026-14288, CVE-2026-15723, CVE-2026-16255), stemming from GitLab's security bulletin released on October 21, 2026, alongside the 19.5.1 patch release. The advisory does not indicate active exploitation in the wild.

Defenders running self-hosted GitLab CE/EE should prioritize upgrading to 19.5.1, 19.4.3, or 19.3.6 (or later) as applicable, referring to GitLab's official patch release notes for full details on each vulnerability and affected components.

## Mentioned in this report

- Vulnerabilities: CVE-2026-103515, CVE-2026-105711, CVE-2026-105777, CVE-2026-110264, CVE-2026-112212, CVE-2026-112326, CVE-2026-112378, CVE-2026-12664, CVE-2026-13319, CVE-2026-14288, CVE-2026-15723, CVE-2026-16255

Source reporting: https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1363

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/567f0014-30d4-508d-91e6-020e2ac172c8/gitlab-patches-multiple-vulnerabilities-in-19-5-1.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup