CVE-2026-100755
GitLab Critical Patch Release: 19.4.2, 19.3.5, 19.2.8
Published Oct 12, 2026 · updated Oct 14, 2026 · GitLab GitLab
On October 12, 2026, we released versions 19.4.2, 19.3.5, 19.2.8 for GitLab Community Edition (CE) and Enterprise Edition (EE). 19.3.4 had a bug that affected merge request pages when the Ona integration was enabled. This is fixed in 19.3.5. These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action. GitLab releases fixes for vulnerabilities in patch releases. There are two t
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 13, 2026 · NIST NVD
Detected
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain deployment configurations, could have allowed an authenticated user to poison cached page content served to other users due to improper cache key construction.
Oct 14, 2026 · NIST NVD
Updated
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain deployment configurations, could have allowed an authenticated user to poison cached page content served to other users due to improper cache key construction.
Oct 14, 2026 · NIST NVD
Updated
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain deployment configurations, could have allowed an authenticated user to poison cached page content served to other users due to improper cache key construction.
Affected
- cpe gitlab/gitlabversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-100755
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2026-100755
30-day exploitation probability 0.1%
first.org - GitLab Security ReleasesVendor advisoryCVE-2026-100755
On October 12, 2026, we released versions 19.4.2, 19.3.5, 19.2.8 for GitLab Community Edition (CE) and Enterprise Edition (EE). 19.3.4 had a bug that affected merge request pages when the Ona integration was enabled. This is fixed in 19.3.5. These versions contain important bug a
docs.gitlab.com - NIST NVDVulnerability recordCVE-2026-100755
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain deployment configurations, could have allowed an authenticated user to poison cached page content served to other users du
nvd.nist.gov