Critical Unauthenticated RCE in GitLab (CVSS 10.0) Affects Every Release Since 2014

GitLab released patches on October 21 for a critical vulnerability rated CVSS 10.0 that allows an attacker to execute code on a self-managed GitLab server without authenticating. According to the report, the flaw affects every GitLab version going back to 7.0, released in 2014 — a span of roughly 12 years of releases.

Why It Matters

This is as severe as it gets: unauthenticated remote code execution on internet-facing GitLab instances means an attacker needs no credentials to potentially gain full control of the server, with access to source code, CI/CD pipelines, secrets, and downstream build infrastructure. Notably, the report states that administrators who patched on October 12 are not fully protected — that earlier update only covered versions 19.2 and later, while the new fix released on October 21 sits one patch above it, leaving a gap for anyone who stopped at the prior update.

What Defenders Should Do Now

• Treat any self-managed GitLab instance, regardless of version or how recently it was patched, as needing verification against the October 21 fix specifically.
• Confirm whether your instance received the October 12 patch alone versus the newer October 21 release, since the summary indicates the earlier fix was incomplete.
• Prioritize checking internet-facing GitLab servers first, given the unauthenticated nature of the flaw.
• At a high level, review GitLab access and application logs around the patch window for anomalous unauthenticated requests to endpoints exposed prior to login, and watch for unexpected process execution or new CI/CD jobs originating from the GitLab host.
• Follow GitLab's official advisory for the specific affected version ranges and upgrade paths, since exact version boundaries were not detailed in the available summary.

This is developing coverage based on an initial report, and full technical details (such as the specific vulnerable component or proof-of-concept availability) were not included in the source material. We will continue to track this story as more information becomes available. Read the original report at The Hacker News.