Description
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under a race condition, the MCP search tool's shared state handling could have caused search results to be returned under an incorrect user context.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| GitLab | GitLab | 18.6 – < 19.2.7, 19.3 – < 19.3.3, 19.4 – < 19.4.1 | 19.2.7 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | gitlab-runner-19.2 +5 | 19.2.6-r1 | — |
Advisories 1
- WID-SEC-2026-3556 GitLab: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 9, 2026