GitLab Patches Critical Flaw Allowing Unauthenticated Code Execution

Past-week coverage · Original source published 2026-10-21.

GitLab shipped fixes on October 21 for a vulnerability rated CVSS 10.0 that could let an attacker run code on a self-managed server without logging in, according to The Hacker News. The report says the flaw affects every version of the software going back to 7.0, released in 2014.

The timing matters for administrators who thought they were already covered. According to the report, an October 12 update addressed only versions 19.2 and later, and the newly fixed versions sit one patch above that earlier release. In other words, patching nine days earlier wasn't enough for older installations.

The source does not name the vulnerability's CVE identifier, describe the underlying technical cause, or say whether exploitation has been observed in the wild. It also doesn't specify which self-managed configurations are exposed beyond the version range. Those gaps are worth noting rather than filling in.

What defenders should do

• Check the GitLab version running on each self-managed instance, including older deployments that may have been left behind.
• Apply the October 21 fixed release rather than relying on the October 12 update.
• Treat internet-facing GitLab servers as the priority, since the flaw is described as requiring no authentication.

The story is a reminder that long-lived self-hosted platforms accumulate exposure. A fix that covers only recent branches leaves the oldest and often least-watched servers carrying the risk.