GitLab Issues Emergency Patch for 12‑Year‑Old Remote Code Execution Flaw

GitLab announced on October 21 that it has released emergency patches for a vulnerability rated a perfect 10.0 on the Common Vulnerability Scoring System, which enables an unauthenticated attacker to execute arbitrary code on any self‑hosted GitLab instance.

The defect, which affects every version of the platform dating back to the 7.0 release in 2014, represents more than a decade of exposure. Because the flaw can be triggered without any credentials, it effectively gives an attacker full control of the underlying server, opening the door to data theft, ransomware deployment or further network compromise.

While the exact technical details have not been disclosed publicly, the advisory indicates that the issue resides in the way GitLab processes certain inbound requests, allowing malicious payloads to be run directly on the host system. The vulnerability is classified as a remote code execution (RCE) flaw, the most severe category of software bugs.

GitLab’s response was swift: patches were issued for all supported releases and, unusually, for legacy versions that are no longer maintained. The company also warned administrators who applied a prior update nine days earlier that the earlier fix does not mitigate this specific vector, and that a second update is required to close the gap.

Security experts stress that the breadth of the affected versions is rare for a flaw of this magnitude. Organizations running self‑managed GitLab servers are urged to apply the new patches immediately, verify that the updates were successful, and review system logs for any signs of suspicious activity that may have occurred before the fix.

In addition to upgrading, GitLab recommends rotating all secret keys and tokens, tightening network access controls around the GitLab instance, and, where feasible, considering migration to the cloud‑hosted GitLab.com service, which is patched automatically.

The incident underscores the challenges of maintaining long‑lived, self‑hosted software stacks. Even well‑intentioned teams that keep their installations reasonably up‑to‑date can be caught off‑guard when a vulnerability spans a dozen years of code.

GitLab has pledged to continue monitoring the situation and will publish a detailed technical advisory in the coming days. Until then, the onus remains on administrators to act quickly, as the window for potential exploitation remains open for any systems that have not yet applied the fix.