← Back to blog

Critical GitLab RCE Flaw Affects 12 Years of Releases

A CVSS 10.0 vulnerability in GitLab allows unauthenticated remote code execution across versions dating back to 2014. All self-managed instances must update immediately.

TL;DR

  • GitLab disclosed a critical flaw (CVE-XXXX-YYYY) enabling unauthenticated RCE.
  • Impacts all versions from 7.0 (2014) to latest, including recent releases.
  • Initial patch on Oct 12 missed older versions; full fix released Oct 21.
  • Self-managed GitLab admins should upgrade to latest patched versions.
  • No evidence of active exploitation, but risk is extremely high.

GitLab has disclosed a critical security vulnerability that allows unauthenticated attackers to execute arbitrary code on self-managed servers. Rated CVSS 10.0, the highest severity score, this flaw affects virtually every version of GitLab released since 2014.

The vulnerability impacts organizations running GitLab Community Edition (CE) and Enterprise Edition (EE) in self-managed deployments. Cloud-hosted GitLab instances are not affected. Administrators who applied the October 12 patches may still be vulnerable, as those updates only addressed newer versions.

Vulnerability Details

  • The flaw enables remote code execution without authentication on self-managed GitLab instances
  • Affects all GitLab versions from 7.0 (released in November 2014) through current releases
  • Cloud-hosted GitLab.com instances are not impacted by this vulnerability
  • Attackers could gain complete control of affected servers without valid credentials

Patch Requirements

  • GitLab released initial patches on October 12, but they only covered versions 19.2 and later
  • Additional patches released on October 21 address all affected versions
  • Administrators must verify their GitLab version and apply appropriate patches
  • Organizations should review GitLab's official advisory for specific version mappings
  • Security teams should monitor for suspicious activity even after patching

Sources

Sources

Security email updates

One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.

Critical GitLab RCE Flaw Affects 12 Years of Releases — Agent Breach Blog | Agent Breach