🔴 Critical: Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases
-
GitLab has released fixes for a critical vulnerability that allows an attacker to execute code on a self-managed server without authentication. The flaw carries a CVSS score of 10.0 and affects every version of the software going back to 7.0, which was released in 2014 — meaning roughly twelve years of releases are impacted.
The October 21 patch is significant even for administrators who updated nine days earlier. The October 12 update only covered versions 19.2 and later, and the newly fixed versions sit one patch above it, so anyone who applied that earlier release remains exposed.
Key points for defenders:
- The vulnerability enables unauthenticated remote code execution on self-managed GitLab instances.
- All versions from 7.0 onward are affected.
- Fixes were published on October 21.
- The earlier October 12 update addressed only 19.2 and later and does not cover older branches.
- Administrators should move to the latest patched release rather than relying on the earlier update.
Given the breadth of affected releases and the lack of authentication required, self-managed GitLab operators should treat this as urgent and verify their current version against the latest fixed release.
Source: The Hacker News
Has your organization already applied the October 21 patch, or are you still running a release from before 19.2?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login