Patch a self-managed GitLab instance by first recording its exact application version, Community or Enterprise edition, deployment method, and node topology. Compare that record with GitLab’s current security advisory, select the fixed release for the same supported branch, follow the upgrade procedure for that deployment, and then verify both the running version and GitLab’s health checks. Do not assume the September 2026 releases remain the current targets: consult the latest advisory immediately before scheduling the change.
The September 10, 2026 critical-release advisory—and its September 23 backports—provides a concrete example of this workflow. GitLab recommended that affected self-managed installations upgrade immediately, but the correct target depends on the branch and the advisory’s affected ranges.
As an Amazon Associate I earn from qualifying purchases.
How do I patch GitLab for a critical vulnerability?
Use this order, without skipping the identification step:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Inventory the instance. Record the exact GitLab version, CE or EE edition, deployment type, number of nodes, and any separate database, Redis, Gitaly, Runner, or chart components.
- Read the current GitLab advisory. Determine whether that exact version is in an affected range and whether the issue applies to your deployment type. If an advisory does not exclude a deployment type, GitLab’s guidance is to treat the issue as applicable across deployment types.
- Select a branch-appropriate fixed release. A fixed version is not universal: choose the release that contains the fix on the supported branch you actually run.
- Plan the change. Check prerequisites, required intermediate upgrade stops, release notes, maintenance policy, resource requirements, and a rollback procedure. Take and validate a complete backup.
- Upgrade using the matching procedure. Linux package and Helm chart installations have different steps, and single-node and multi-node package installations are not interchangeable.
- Verify. Confirm the intended version is running, all migrations and deployment jobs have completed, and run GitLab’s configuration, migration, secrets, and UI checks.
An upgrade is not verified merely because a package command or chart deployment finished. Verification means the fixed build is running and the application’s critical services and workflows pass post-upgrade checks.
#1 Best Overall
What the September 2026 critical fixes show
The following releases are a current example, not a permanent version list. GitLab published the first release on September 10, 2026 and later backported the two fixes on September 23 for additional supported branches.
| Advisory date | Fixed GitLab releases listed | How to use the information |
|---|---|---|
| September 10, 2026 | 19.3.2, 19.2.6, 19.1.8 | Use the release corresponding to the affected branch, subject to the current advisory and any required upgrade stops. |
| September 23, 2026 backport | 19.0.9, 18.11.12 | Supported installations on those branches could receive the fixes without first moving to a newer minor version. |
Read the primary notices before selecting a target: GitLab Critical Patch Release: 19.3.2, 19.2.6, 19.1.8 and GitLab Critical Patch Release: 19.0.9, 18.11.12. Check for a newer advisory, changed support status, or later fixed releases before acting.
CVE-2026-85706: repository commits API path traversal
GitLab describes a path-traversal issue in the repository commits API. Under certain conditions, an unauthenticated user could read arbitrary files from the GitLab server. The September advisory lists affected ranges beginning with 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2. Compare the full version string—not only the major or minor number—with the current advisory.
Free tools Windows power users keep installed
One-click scans. No signup required.
CVE-2026-87719: GraphQL subscription serializer
GitLab describes an insecure-deserialization issue in the GraphQL subscription serializer affecting GitLab Enterprise Edition. The complete affected and fixed range, and any later updates, must be taken from the current official advisory. Do not infer that an installation is safe from the CVE number alone or from the fix for the other issue.
How can I check whether my GitLab version is affected?
Record the application version and edition
Obtain the exact three-part GitLab application version from an authoritative local record, such as the instance’s Help or About screen, the package inventory, or the deployment’s release metadata. Record whether the instance is Community Edition or Enterprise Edition. Keep the edition with the version because an EE-specific issue cannot be evaluated correctly from a version number alone.
Do not round a version to “19.3” or report only the chart version. A security range can distinguish 19.3.1 from 19.3.2, and a Helm chart’s number does not necessarily match the GitLab application version. If the instance has multiple application nodes, confirm that they all run the same intended version rather than checking only one node.
Record how GitLab is deployed
- Linux package: note whether the installation is single-node or distributed across multiple application, Sidekiq, Gitaly, database, or other service nodes.
- Helm chart: record both the chart release and the GitLab application version, then check the chart-to-application mapping.
- Another deployment type: identify its official GitLab upgrade guide. Do not copy package or Helm commands into an unsupported deployment.
Also document external dependencies, custom configuration, CI/CD Runner versions, maintenance windows, and the person who can approve rollback. This inventory determines which prerequisites and migration sequencing rules apply.
Compare against the advisory’s ranges
Open the current release notice and locate each CVE’s affected and fixed ranges. An advisory-specific range controls the decision; the September 2026 example cannot be generalized to future advisories. When the notice says an issue applies across deployment types unless one is called out, treat a matching self-managed installation as affected regardless of whether it uses a package or a chart.
Save the advisory URL, your recorded version, edition, and the selected fixed target in the change record. If the version is outside the listed ranges, still check whether a newer advisory or a different branch policy applies before deciding that no action is needed.
Choose the right fixed release for the branch
Branch matching prevents two common mistakes: installing a release that does not contain the specific fix, or forcing an unnecessary minor-version move during an emergency patch. Compare candidate targets using all four questions below:
| Decision question | What to establish |
|---|---|
| Does it fix the CVE? | The current advisory explicitly lists the release as fixed for the relevant issue. |
| Is it on the supported branch? | The target is available for the branch your installation runs and is still maintained. |
| Are intermediate stops required? | The upgrade plan and release notes specify any mandatory sequential versions; a package manager cannot bypass them. |
| Can the deployment perform the documented procedure? | Your topology, maintenance window, storage, memory, and migration capacity meet the target release’s requirements. |
For the September 2026 example, the fixed choices were 19.3.2 for the 19.3 line, 19.2.6 for 19.2, 19.1.8 for 19.1, 19.0.9 for 19.0, and 18.11.12 for 18.11. Those numbers are release identifiers from that advisory, not a promise that they are current or appropriate for every installation. If your branch is older, unsupported, or outside the listed choices, stop and build an upgrade path from the current maintenance policy rather than selecting a number by proximity.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Prepare a safe maintenance window
Read the planning material first
GitLab’s Before you upgrade guidance covers prerequisites, supported paths, release maintenance, and health checks. Review it together with the destination release notes and the deployment-specific guide. Pay particular attention to required intermediate stops: some upgrades require migrations or staged version changes, and skipping one can leave the database or application in an unsupported state.
Rank #3
Make and test a rollback plan
Create a full, current backup that includes the database, repositories, uploads, artifacts, registry data where applicable, configuration, and secrets needed to restore the service. Verify that the backup can be read and that you know where the restore procedure and credentials are kept. Do not rely only on an automatic database backup created as a side effect of an upgrade; it may not cover every data store or give you a usable recovery point.
Define who can stop the rollout, how DNS or load-balancer traffic will be handled, where logs will be collected, and what evidence is required before reopening service. Record the currently running version so rollback decisions are unambiguous.
Control application activity
Decide whether to enable maintenance mode, pause CI/CD pipelines and jobs, and drain or stop traffic according to the deployment guide. Notify users about the expected interruption. Align GitLab Runner versions with the target GitLab version where GitLab’s package procedure calls for it. Confirm that the maintenance window is long enough for database migrations and workload rollouts; a security patch that is interrupted during a migration can require recovery work before another upgrade attempt.
Recommended Free Tools
Upgrade a Linux package installation
Single-node procedure
Use GitLab’s Upgrade Linux package instances instructions for the exact target. The documented sequence includes:
- Check the target release’s prerequisites and core dependencies.
- Confirm your backup and rollback material are available.
- Consider maintenance mode and pause CI/CD pipelines and jobs.
- Align Runner with the target GitLab release where required.
- Upgrade GitLab with the Linux package, using an official repository when possible. GitLab also documents installing a downloaded package, but recommends the official repositories.
- Wait for package configuration and every required database migration to finish. Do not begin the next mandatory upgrade step while migrations remain pending.
- Resume jobs and disable maintenance mode only after the post-upgrade checks pass.
Select the exact package version specified by your branch plan. Do not assume that accepting the package manager’s newest available version follows GitLab’s required path; repository metadata cannot bypass a mandatory intermediate stop.
Multi-node procedure
Multi-node installations require the corresponding multi-node sequence, including coordination of application nodes, background workers, and stateful services. Do not apply a single-node shortcut to a distributed topology. Follow the documented order for draining traffic, upgrading each role, running migrations, and restoring service. Keep all nodes on a compatible version during the transition and verify the final version on every application node.
Package-specific failure boundaries
- If dependency checks fail, stop and satisfy the documented prerequisite instead of forcing installation.
- If a migration is still running, preserve the migration output and wait or troubleshoot according to GitLab’s recovery guidance; do not start another upgrade step.
- If only some nodes were upgraded, keep traffic controlled and follow the multi-node recovery procedure before declaring the release deployed.
Upgrade a GitLab Helm chart installation
Map the chart to the application release
Start with GitLab’s Upgrade GitLab Helm chart instances documentation. Check the chart-to-GitLab version mapping and read the changelog for the destination chart. Chart and application versions do not necessarily use the same numbering, so a chart value that looks like the desired GitLab version is not sufficient evidence.
Use the documented staged rollout
- Back up the installation and verify the restore materials before changing the release.
- Confirm Kubernetes capacity, storage, and any target-version resource requirements.
- Review the destination chart’s upgrade notes and identify migration jobs required by that chart.
- Apply the documented chart upgrade using your existing values and the selected target mapping.
- Monitor migration jobs and workload rollouts until they complete successfully. Treat a failed or incomplete migration as a blocked upgrade, not a cosmetic warning.
- Check that all GitLab components become ready on the intended application version.
- Turn off maintenance mode only after health checks and representative workflows succeed.
The exact release names, migration jobs, and required commands depend on the chart and installation. Use the commands and values in the version-specific GitLab guide rather than substituting Linux package commands or an unverified generic Helm command.
What to do for other deployment types
If GitLab runs through a deployment method not covered above, use the official instructions for that exact method and topology. The security decision remains the same—compare the exact application version with the advisory and deploy a fixed branch release—but the mechanics, ordering, backup scope, and health checks may differ. Do not infer that a container image tag, operator version, or chart version is identical to the GitLab application version. Record the resulting application version from the running service after the change.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How do I verify the GitLab security fix worked?
Run the checks immediately before and after the upgrade, as GitLab recommends in its planning guidance. A before-and-after record lets you distinguish a pre-existing fault from a regression introduced during patching.
- Run the general configuration check. On a Linux package installation, run
sudo gitlab-rake gitlab:check. Review the complete output, not only the exit status, and preserve it with the change record. - Confirm database migrations are complete. Every background migration required by the target must finish before the next upgrade step and before you declare the service ready. For a Helm deployment, confirm the documented migration jobs completed successfully; for a package deployment, review the upgrade output and instance status.
- Check encrypted database values. Run
sudo gitlab-rake gitlab:doctor:secretson a Linux package installation and investigate any decryption error. A successful version change does not prove that encrypted credentials can be read. - Confirm the running version. Check the instance and every application node against the intended fixed release for the relevant branch. Verify the edition as well as the version, particularly when evaluating the EE-only deserialization issue.
- Check the UI and key workflows. Sign in through the normal administrative path, confirm the instance is reachable, and test representative project access, repository browsing, issue or merge-request operations, CI/CD pipeline behavior, artifact access, and other workflows your organization relies on. Keep the tests proportionate to your deployment and maintenance plan.
- Review deployment and service logs. Look for failed migrations, crash loops, readiness failures, background-worker errors, database connection problems, or permission errors. A green configuration check cannot compensate for a service that is not serving traffic correctly.
These checks establish that the intended release is running and that core configuration, migrations, secret decryption, and workflows are healthy. They do not reproduce either vulnerability and do not constitute an exploit test. The security conclusion should therefore be phrased narrowly: the instance is on the advisory’s fixed release, and the documented post-upgrade checks passed.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsTroubleshoot verification failures before reopening service
The version is not the intended target
Keep maintenance controls in place, identify which node or workload still reports the old version, and compare package, chart, image, and application records. In a multi-node or Kubernetes deployment, a partially rolled-out workload can leave mixed versions. Follow the deployment-specific rollback or completion procedure; do not simply repeat the upgrade command.
Best Value
Migrations are incomplete or failing
Preserve migration logs and the exact release transition. Check whether the upgrade plan requires an intermediate version or additional capacity. Do not begin another version jump while a required migration is pending. Use GitLab’s troubleshooting and recovery instructions for the affected deployment type, and restore from the prepared backup only under the rollback plan.
gitlab:check reports errors
Capture the full output, classify each finding as pre-existing or introduced by the upgrade, and correct configuration, permissions, dependency, or service-state problems according to GitLab’s documentation. A failed general check means the instance is not ready for a “verified” status even if the package or chart operation completed.
Secret decryption fails
Stop the rollout and protect the encrypted data and secrets needed for recovery. Preserve the error and verify that the correct secrets configuration was retained during the deployment. Follow GitLab’s recovery guidance before restarting application traffic; do not replace keys or delete encrypted records as an ad hoc fix.
The UI or workflows fail
Keep maintenance mode or traffic controls enabled, save application and infrastructure logs, and test whether the failure affects one project, one node, or the whole instance. Check migration and worker status first, then use the release-specific troubleshooting path. Reopen service only when the intended version, health checks, and the workflows defined in your change plan all pass.
Document the patch and verification
Close the change only when the record contains the advisory URL and date consulted, CVEs evaluated, original and final versions, edition, deployment method, topology, backup identifier, maintenance window, intermediate stops, migration results, health-check output, UI test results, and any exceptions. Note whether the September 2026 releases were used as targets or merely as a comparison example. This evidence makes a later audit or incident review possible without relying on memory.
Finally, schedule a fresh advisory review rather than treating one patch as permanent coverage. GitLab can publish later fixes, backports, or revised affected ranges. The durable practice is to repeat the same sequence—identify, compare, plan, upgrade, and verify—whenever a new critical advisory affects a self-managed branch.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
