GitLab.com CI/CD disrupted during a scheduled rate-limit preview

GitLab.com is investigating a disruption to its CI/CD service that left merge trains stuck and pipelines failing to start on 14 October 2026, according to the company's status page. The incident appeared the same day as a scheduled preview window for new GitLab.com rate limits. GitLab says it is investigating and has not stated a cause.

What's happening

On its status page, GitLab lists the CI/CD component as having a "Partial Service Disruption," while components such as the website, API, Git operations, the container registry, and hosted runners for Linux, Windows, and macOS are shown as operational. The incident is tracked in GitLab's infrastructure project as work item #23192, titled "2026-10-14: Merge trains stuck and train pipelines not starting."

The status timeline shows two updates. At 14:33 UTC, GitLab said it was investigating an issue affecting GitLab.com merge trains: "Some merge train pipelines may remain in the created state for an extended period or fail to start, causing merge trains and related CI/CD workflows to stall." At 15:22 UTC, the scope widened: merge train, scheduled, and child/downstream pipelines "may be delayed, remain in a created or pending state, or fail to start," and mergeability analysis and webhook notifications may also be delayed. GitLab has not published a root cause.

Separately, GitLab is changing how rate limits work on GitLab.com. In a blog post published on 17 September 2026, GitLab said that from 19 October 2026 its rate limits will align with subscription tier, with Free accounts and unauthenticated requests going first and Premium and Ultimate following in January 2027. To prepare customers, GitLab scheduled two preview windows — short, planned "brownouts" — on 7 and 14 October between 15:00 and 19:00 UTC, during which the new limits are briefly switched on and then off. The 14 October incident overlapped the second window; GitLab has not said whether the two are related.

Who's affected

The disruption affects teams that rely on GitLab.com's CI/CD in the ways the status updates describe: merge trains that stall, and scheduled, child, or downstream pipelines that stay in a "created" or "pending" state or fail to start. Because mergeability analysis and webhook notifications may be delayed, workflows that depend on those signals can also back up, even where the underlying build infrastructure is up.

The rate-limit change is broader but separate. It applies only to GitLab.com; GitLab says Self-Managed and Dedicated limits stay with the operator. A request with no credentials is capped at 60 requests per hour per IP address, and GitLab notes that unauthenticated requests are capped no matter where they come from, including automation running against a paid account without credentials. GitLab says almost all users are already inside the new limits.

What to do

Watch GitLab's status page (status.gitlab.com) and the incident work item for recovery updates; if your merge trains are stuck, avoid repeatedly re-triggering pipelines while the incident is open.
Do not assume the rate-limit preview caused the incident; GitLab has not confirmed a link, so treat the coincidence as unverified.
For the upcoming limits, authenticate your API requests (a personal access token, an OAuth token, or the CI/CD job token) to move off the anonymous 60-requests-per-hour allowance and onto your plan's limits.
Reduce API pressure: batch, cache, and paginate calls, and avoid tight polling loops.
Handle limits gracefully: a capped request returns HTTP 429 with a Retry-After header, so read the response headers and back off (exponential backoff recovers faster than immediate retries).

Sources

GitLab System Status — the incident timeline showing the CI/CD disruption and the 14:33 and 15:22 UTC updates.
GitLab Infrastructure (work item #23192) — the incident record titled "Merge trains stuck and train pipelines not starting."
GitLab — explains the rate-limit change, the 7 and 14 October preview windows, and the guidance to authenticate requests.