Upcoming GitLab 19.5.3 release - Under investigation

GitLab has published the release notes in the meantime.

The main issue addressed is related to CVE-2026-111943, removing trust for compromised eMudhra intermediate CA certificates.

Under certain conditions, attackers could exploit these compromised certificates to impersonate external services that GitLab connects to over TLS, potentially allowing them to intercept or manipulate communications. This is not a directly exploitable vulnerability in GitLab’s web interface.

The release notes also include a separate warning regarding self-hosted GitLab Runners. Our runners are already running the recommended version 19.5.1.

Based on our assessment of the exposure, we do not consider an emergency maintenance window necessary. We plan to upgrade GitLab during our next scheduled maintenance window on Tuesday, November 3.

If you would prefer us to apply the GitLab 19.5.3 update before the next scheduled maintenance window on Tuesday, November 3, please contact us to arrange an earlier upgrade.

GitLab Admin UI is currently warning regarding version 19.5.1 being vulnerable and recommends users to upgrade to 19.5.3.

We see that updated packages are available, but there are neither official release notes nor an official security notification as of now.

We are therefore actively monitoring these channels and wait with an assessment whether an immediate patch is necessary until more information becomes available.

In case you want us to do the update regardless, please reach out to us. Be aware that we don’t know the full scope of the update and its impact at this point.

We will provide an update once we have more clarity.