GitLab removes trust for compromised eMudhra CA certificates; update
Original title：GitLab Patch Release and Security Update: 19.5.3, 19.4.5, 19.3.7, 19.2.10, 19.1.10, 19.0.11, 18.11.14
What happened
GitLab released patches that stop trusting eight eMudhra intermediate CA certificates whose private keys were compromised. Self-managed users must also update GitLab Runner and AI Gateway separately, or the fix will not apply to them.
Who is affected
- Anyone running self-managed GitLab
- Users of self-hosted GitLab Runner
- Orgs running their own AI Gateway
What to do
Upgrade self-managed GitLab to a fixed version. Also update GitLab Runner to 19.5.1, rebuild CI/CD job images that bundle ca-certificates, and update AI Gateway.
Affected products
| Product | Affected | Fixed in |
|---|---|---|
| GitLab CE/EE | 18.11.14 より前の全バージョン、19.0 は 19.0.11 未満、19.1 は 19.1.10 未満、19.2 は 19.2.10 未満、19.3 は 19.3.7 未満、19.4 は 19.4.5 未満、19.5 は 19.5.3 未満 | 19.5.3, 19.4.5, 19.3.7, 19.2.10, 19.1.10, 19.0.11, 18.11.14 |
| GitLab Runner (self-hosted) | 要確認 | 19.5.1 |
| GitLab AI Gateway (self-hosted) | 要確認 | 18.11.8, 19.0.13, 19.1.9, 19.2.5, 19.3.3, 19.4.3, 19.5.3 |
Why this flag
悪用の言及はなく、条件付きの更新対応（Runner・AI Gateway の別途更新が必要）のため YELLOW を提案。
Yellow flag: caution, slow down — Conditional updates, investigation or recovery follow-ups, and regulatory deadlines.
Sources
- Primary source：GitLab Security Releases ↗
- CVE：CVE-2026-111943 ↗