Vulnerabilities · Application Security
Critical GitLab bug lets attackers run code on servers from 12 years of releases
A newly patched GitLab flaw lets unauthenticated attackers run code on self-managed servers. The bug affects releases going back 12 years. GitLab urges all users to update immediately.
Ross Grant2 min read
The short version
A serious bug in GitLab, a popular software development platform, could let attackers take over servers that have not been updated. The flaw affects versions released over the last 12 years. GitLab has released fixes and says everyone running their own server should update right away. There is no sign yet that criminals have used this bug, but experts expect attacks to start soon.
By the numbers
- 12 yearslength of time affected GitLab versions have been vulnerableThe Register
- 50 millionGitLab's claimed number of registered usersThe Register
- 10.0CVSS severity score for the vulnerabilityThe Register
What happened?
GitLab patched a critical vulnerability that lets unauthenticated attackers run code on self-managed servers. The flaw affects both Community and Enterprise editions, with releases dating back to 2014. GitLab urges all users to upgrade immediately. There is no evidence yet of active exploitation, according to The Register.
Who is affected
According to The Register (opens in a new tab), this vulnerability affects both GitLab Community Edition (CE) and Enterprise Edition (EE) versions dating back to 7.0, released in June 2014. That covers 12 years of releases. The bug only impacts self-managed GitLab servers. GitLab.com and GitLab Dedicated, which are managed by the company, have already been patched.
GitLab claims to have 50 million registered users and says more than half of Fortune 100 companies use its products. This means the number of potentially exposed organisations is significant, especially those running their own GitLab infrastructure.
How the flaw works
The bug is an integer overflow in the way GitLab compiles regular expressions. An attacker can exploit this by sending a specially crafted regular expression to the server. If successful, this lets an unauthenticated attacker run arbitrary code on the GitLab server. In plain English, someone who is not logged in could take control of the server, depending on how it is set up.
The flaw is tracked as CVE-2026-110264 and has been given the highest possible CVSS severity score of 10.0. This means it is considered both easy to exploit and very dangerous.
The response
GitLab released fixes for this bug in versions 19.5.1, 19.4.3, and 19.3.6. The company also backported patches to older versions: 19.2.9, 19.1.9, 19.0.10, and 18.11.13. GitLab "strongly recommends" that all organisations running affected versions upgrade to a fixed release as soon as possible. The company also published two threat detection rules for customers running self-managed instances.
The vulnerability was reported by bug hunter Johan Carlsson through GitLab’s HackerOne bug bounty programme.
What experts say
Threat detection firm SOC Prime warned that the potential impact is severe for organisations running self-managed GitLab. GitLab servers often store source code, CI/CD configuration, deployment secrets, access tokens, and infrastructure definitions. If an attacker gains control of the server, they could steal credentials, change repositories, launch supply chain attacks, or move laterally within the network.
There is no evidence yet of attackers exploiting this bug in the wild. However, SOC Prime expects criminals to start scanning for vulnerable servers soon. The Register notes that with a flaw this serious, defenders may only have a short window to patch before attacks begin.
Is there a fix?
Yes. GitLab has released patched versions and urges all users of self-managed servers to update immediately. Managed GitLab services are already protected.
Why it matters
This flaw could let attackers take control of servers that store sensitive code and credentials. Many large organisations use self-managed GitLab, so the risk is widespread. Patching quickly is critical to prevent breaches.
Key points
- A critical GitLab bug lets unauthenticated attackers run code on servers.
- The flaw affects 12 years of releases, from version 7.0 onward.
- GitLab has released patches and urges immediate updates.
- No active exploitation has been reported yet, but experts expect attacks soon.
- Self-managed servers are at risk; GitLab-managed services are already patched.
Sources
The Register
Reference
