GitLab Self-Managed Patch Guide: Moving to 19.4.1, 19.3.3, or 19.2.7

The GitLab critical patch release dated September 23, 2026 closes 11 security flaws, including two remote code execution paths rated 9.9. Administrators who run self-managed instances are the audience for this release; hosted customers are not.

What needs to change

Choose the fixed release that matches your current branch: 19.2.7 for 19.2 installations, 19.3.3 for 19.3, and 19.4.1 for 19.4. Anything below those points on the affected branches remains exposed to CVE-2026-89078, a double free in regex handling, and CVE-2026-93577, an integer overflow in the same processing path.

Planning the upgrade

Multi-node environments can follow GitLab's zero-downtime procedure, so an upgrade window does not have to mean an outage. Single-node installations need a maintenance window sized to the usual package update and service restart.

Accounts and variables to review while you wait

Until the upgrade lands, the practical controls are access and permissions. Restrict reachability of the GitLab web and API interfaces, and look closely at which accounts, tokens, and service accounts can push CI/CD configuration, because that is the access an attacker needs. Rotate CI variables on any instance that has been internet-facing while unpatched.

Who is not affected

GitLab.com and GitLab Dedicated were handled by the vendor. Customers on those offerings do not need to install anything for this release.

Checking exposure

A ZoomEye query for app="GitLab" on 2026-09-24 returned 1,316,748 assets carrying that fingerprint. Use the figure to size the population of internet-facing GitLab deployments, and remember that it cannot tell you whether a given host runs a fixed version.

Verification after patching

Confirm the running version through the admin area or the version endpoint, then re-check that pipeline configuration permissions match your policy. Version confirmation is the part that closes the loop; an assumed upgrade is not evidence.

References

SecurityOnline, "GitLab Critical Patch Release Fixes Severe RCE Flaws," September 23, 2026: https://securityonline.info/gitlab-critical-patch-release-rce/