Tech · 12 d ago
GitLab patches a maximum-severity flaw that reaches back 12 years
The flaw lets an attacker run code on a self-managed server without logging in, and it affects every version since 7.0, released in 2014.
Severity score
10.0 CVSS
The flaw, tracked as CVE-2026-110264, is rated 10.0, the maximum on the CVSS scale.
What we know
- GitLab.com already runs the fixed version
- No attacks have been reported
Not yet
- The conditions an attacker needs
GitLab reports no attacks and offers no workaround, but has not said what conditions an attacker needs.
What to do
Administrators of self-managed servers should upgrade to a fixed version such as 19.5.1, 19.4.3 or 19.3.6.
