GitLab RCE Exploit Published for Unpatched Self-Managed Servers
A proof-of-concept exploit targets a critical GitLab vulnerability allowing command execution as git. Organizations running unpatched self-managed instances are at risk.
TL;DR
- Researchers published an RCE PoC for GitLab CVE patched in June 2026
- Authenticated users can execute commands on vulnerable 18.11.3 servers
- Exploit requires push access and leverages Jupyter notebook commit diffs
- Heap memory leakage enables further compromise of GitLab instances
- Immediate patching recommended for all self-managed GitLab deployments
Security researchers at depthfirst have released a working exploit for a GitLab vulnerability that was patched six weeks ago. The flaw affects GitLab's self-managed edition version 18.11.3 and allows authenticated users with project push permissions to execute arbitrary commands as the git user.
The exploit works by committing a specially crafted Jupyter notebook file and then viewing its commit difference. This process triggers heap memory leakage that can be leveraged for remote code execution. Organizations that haven't applied the June 10th security update are currently exposed to this attack vector.
This disclosure highlights the ongoing risks organizations face when running outdated software versions, particularly in development environments where authentication credentials may be widely distributed among team members.
Vulnerability Details
- Affects GitLab self-managed edition version 18.11.3 specifically
- Patched by GitLab on June 10, 2026, approximately six weeks before public exploit release
- Requires only authenticated access with push permissions to at least one project
- Exploitation involves crafting malicious Jupyter notebook files and examining commit diffs
- Successful exploitation grants attackers command execution privileges as the git system user
Security Recommendations
- Immediately update all self-managed GitLab instances to version 18.11.4 or later
- Review access controls and limit push permissions to trusted users only
- Monitor GitLab logs for suspicious commit patterns involving Jupyter notebooks
- Consider implementing additional monitoring for unusual heap memory allocation patterns
- Audit existing projects for unauthorized or unexpected notebook files that could indicate attempted exploitation
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.