GitLab shipped emergency fixes on October 21 for a critical remote code execution vulnerability. The flaw lets an unauthenticated attacker run arbitrary code on self-managed GitLab instances. The bug has existed in every release since version 7.0, which launched in 2014.
The vulnerability carries a CVSS score of 10.0, the maximum severity rating. An attacker can exploit it without any credentials. This makes self-managed installations especially vulnerable.
Many administrators believed they were safe after applying the October 12 update. That earlier release only covered GitLab 19.2 and later versions. The October 21 fix extends protection to all affected releases going back twelve years. Teams running older builds remained exposed until the new patch landed.
The flaw allows code execution on the server. Attackers can read sensitive data, create accounts, or disrupt operations. Self-managed users bear the full burden of patching.
Upgrade to the latest patched release immediately. Verify the patch applied correctly by checking the version string. Review server logs for signs of unauthorized access. Rotate any secrets stored in the instance.
Which GitLab versions are affected? Every release from 7.0 (2014) through the pre-patch 19.2 builds. The October 21 fix covers all of them.
How severe is this vulnerability? It scores 10.0 on the CVSS scale, the highest possible. An unauthenticated attacker can execute code on the server.
Does the October 12 patch protect older versions? No. That update only covered 19.2 and later. The October 21 release extends the fix back to version 7.0.