GitLab has released fixes for a critical vulnerability that allows attackers to execute code on self-managed servers without authentication. This flaw affects all versions of the software released since 7.0 in 2014.
The vulnerability is critical, carrying a CVSS score of 10.0, and enables remote code execution (RCE). Administrators who had previously patched on October 12 need to apply the latest fixes, as the earlier update only covered versions 19.2 and later.
By the numbers
- CVSS score
- 10.0
Sources and references
Original report
Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases
The Hacker News
Read on The Hacker News (opens in a new tab)Ref 001QDNSZ
Cite this
APA
Interestana AI Editorial. (2026, October 21). GitLab Critical Flaw Allows Unauthenticated RCE. Interestana. https://interestana.com/articles/critical-gitlab-flaw-cvss-100-could-allow-unauthenticated-rce-across-12-years-of-releases-001qdnsz
MLA
“GitLab Critical Flaw Allows Unauthenticated RCE.” Interestana, 21 Oct. 2026, interestana.com/articles/critical-gitlab-flaw-cvss-100-could-allow-unauthenticated-rce-across-12-years-of-releases-001qdnsz.
Chicago
Interestana AI Editorial. “GitLab Critical Flaw Allows Unauthenticated RCE.” Interestana, October 21, 2026. https://interestana.com/articles/critical-gitlab-flaw-cvss-100-could-allow-unauthenticated-rce-across-12-years-of-releases-001qdnsz.
BibTeX
@misc{interestana_001qdnsz,
author = {{Interestana AI Editorial}},
title = {{GitLab Critical Flaw Allows Unauthenticated RCE}},
howpublished = {Interestana},
year = {2026},
month = oct,
url = {https://interestana.com/articles/critical-gitlab-flaw-cvss-100-could-allow-unauthenticated-rce-across-12-years-of-releases-001qdnsz},
note = {Summary of reporting by The Hacker News, https://thehackernews.com/2026/10/critical-gitlab-flaw-cvss-100-could.html}
}Credit the source
Original reporting: The Hacker News, “Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases”, https://thehackernews.com/2026/10/critical-gitlab-flaw-cvss-100-could.html(opens in a new tab)
Follow this story
Get Cybersecurity in your inbox — new stories in 40 words or fewer, once a week.
Subscribe