The Center for Internet Security warns that a newly disclosed GitLab vulnerability is already being targeted by attackers and could let them seize full control of affected servers.
A serious security flaw in GitLab, a widely used platform that software development teams rely on to manage code and collaborate on projects, could let attackers take over a server without even needing a password, according to the Center for Internet Security.
The vulnerability affects GitLab’s Community and Enterprise editions. An attacker who is not logged in could exploit a flaw in how the software checks certain code patterns to run their own commands on the server, potentially gaining complete control of it, the center said.
This matters because GitLab is used by businesses and government organizations to store and manage source code, meaning a successful attack could expose sensitive data or hand an outsider the keys to an organization’s software infrastructure. The center rated the risk as high for large and medium-sized businesses and government entities, and medium for small organizations. Home users face low risk.
According to the Center for Internet Security, attackers have already attempted to exploit the flaw since it became public. The organization Alpine Linux reported an attempted attack on its own GitLab system on October 20 and 21, 2026.
The flaw affects specific version ranges: GitLab CE/EE 19.2 before version 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2.
The Center for Internet Security recommends that organizations running affected versions apply GitLab’s available security patches immediately after testing them. The center also advises running software with the minimum privileges necessary, rather than administrative access, to limit the damage if an attack does succeed.
For most everyday internet users, this particular issue poses little direct risk since it concerns software used by development teams rather than the general public. Organizations that use GitLab, however, should prioritize updating to the patched versions as soon as possible.
Based on a release from Center for Internet Security.
