<![CDATA[🔴 Critical: Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases]]>GitLab has released fixes for a critical vulnerability that allows an attacker to execute code on a self-managed server without authentication. The flaw carries a CVSS score of 10.0 and affects every version of the software going back to 7.0, which was released in 2014 — meaning roughly twelve years of releases are impacted.

The October 21 patch is significant even for administrators who updated nine days earlier. The October 12 update only covered versions 19.2 and later, and the newly fixed versions sit one patch above it, so anyone who applied that earlier release remains exposed.

Key points for defenders:

  • The vulnerability enables unauthenticated remote code execution on self-managed GitLab instances.
  • All versions from 7.0 onward are affected.
  • Fixes were published on October 21.
  • The earlier October 12 update addressed only 19.2 and later and does not cover older branches.
  • Administrators should move to the latest patched release rather than relying on the earlier update.

Given the breadth of affected releases and the lack of authentication required, self-managed GitLab operators should treat this as urgent and verify their current version against the latest fixed release.

Source: The Hacker News

Has your organization already applied the October 21 patch, or are you still running a release from before 19.2?

]]>https://xploitlk.com/topic/794/critical-critical-gitlab-flaw-cvss-10.0-could-allow-unauthenticated-rce-across-12-years-of-releasesRSS for NodeTue, 27 Oct 2026 07:25:05 GMTMon, 26 Oct 2026 02:30:18 GMT60