GitLab released versions 19.4.2, 19.3.5 and 19.2.8 on October 12, 2026. Among the fixes is CVE-2026-96893 in GitLab EE’s Duo Agent Platform: manipulated AI instructions could trigger unintended commands attributed to other users.
GitLab rates this flaw High, with a CVSS score of 7.3. An attacker needs an authenticated account with low privileges, and user interaction is required. The notice does not claim active exploitation.
Affected GitLab EE releases run from 19.1 to before 19.2.8, plus 19.3 before 19.3.5 and 19.4 before 19.4.2. In its October 12 notice, GitLab urged immediate upgrades for self-managed installations and said GitLab.com was already patched; GitLab Dedicated customers did not need to take action.
What a team owner should do
Ask your administrator to check the installed version and agree an upgrade window. Allow downtime for a single-node installation: database migrations must finish before GitLab can start. Afterward, ask for confirmation of the version and a check of the team’s core workflows.
Prepared by the NADALI editorial team using AI
Source checked on 13 October 2026. Patch release date: 12 October 2026.
