A serious software bug in the GitLab development platform could let hackers run their own code on vulnerable servers, and attacks are already being attempted, according to the Center for Internet Security.
A security flaw in GitLab, a widely used platform for managing software code and development projects, could allow an attacker to take full control of a vulnerable server without even needing a username or password, according to the Center for Internet Security (CIS).
The problem lies in how GitLab checks a type of code pattern used in its automated build and testing tools. By submitting a specially crafted pattern, an attacker could trick the system into running commands of their choosing, according to CIS. If successful, this could give the attacker complete control of the affected server and access to sensitive data stored on it.
CIS reports that attempted exploitation has already been observed since the flaw became public. Alpine Linux, an organization that runs its own GitLab system, reported an attempted attack against its instance on October 20 and 21, 2026.
The issue affects GitLab’s Community and Enterprise editions, specifically versions 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. CIS rates the risk as high for medium and large government agencies and businesses, and medium for smaller organizations. The agency rates the risk to home users as low, since this type of vulnerability mainly affects organizations running their own GitLab servers rather than individual computer users.
GitLab is a tool used by software teams to store code, track projects, and automatically test and deploy software, so an attack on a vulnerable server could expose a company’s internal projects and data.
CIS recommends that organizations running GitLab apply the vendor’s security patches as soon as possible, after appropriate testing. The agency also advises general precautions such as limiting administrator access to dedicated accounts, running software with the fewest privileges necessary, and regularly scanning systems exposed to the internet for vulnerabilities.
Based on a release from Center for Internet Security.
