A newly disclosed security flaw in the widely used GitLab software platform could let attackers take over servers remotely, and researchers say exploitation attempts are already underway.
A serious security flaw has been found in GitLab, a platform many software development teams use to store code and manage projects, according to the Center for Internet Security. The flaw could let an attacker who hasn’t even logged in run their own commands on a vulnerable GitLab server, potentially taking full control of it.
The problem lies in how GitLab checks a certain kind of text pattern, called a regular expression, used in its automated build and deployment settings. According to the Center for Internet Security, an attacker could craft a malicious version of this pattern to trick the system into executing unauthorized code.
This matters because GitLab is a central hub where organizations keep their source code and automate how software gets built and released. If a server is compromised, an attacker could potentially access sensitive data or use the breach as a foothold to cause broader damage. The Center for Internet Security rates the risk as high for medium and large government and business organizations, moderate for small organizations, and low for home users, since this software is mainly used by organizations rather than individuals.
This isn’t just a theoretical risk. The Center for Internet Security notes that exploitation attempts have already been spotted in the wild. Alpine Linux, an organization that runs its own GitLab instance, reported an attempted attack against its system on October 20 and 21, 2026, shortly after the flaw became public.
The vulnerable versions include GitLab Community and Enterprise Editions prior to 19.2.8, 19.3.5, and 19.4.2.
The Center for Internet Security recommends that organizations running GitLab apply the vendor’s available patches immediately, after appropriate testing. Organizations are also encouraged to run software with the lowest privileges necessary and to maintain regular vulnerability scanning and remediation processes to catch issues like this quickly.
Based on a release from Center for Internet Security.