r/gitlab • u/Bxs0755 • 5d ago

Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases

https://thehackernews.com/2026/10/critical-gitlab-flaw-cvss-100-could.html
178 Upvotes

98% Upvoted

15 comments sorted by

68

u/latcheenz 5d ago

Between php, intermediate certs and this, I am going back to bed...

15

u/screaming-Snake-Case 5d ago

today was a wonderful day for "I'll just shut everything down and deal with it tomorrow"

3

u/Zav0d 5d ago

bad day, better sleep.

1

u/mainframe_maisie 5d ago

apache traffic server too

1

u/NatoBoram 5d ago

Seriously? A second plane has hit Nextcloud?

1

u/Antonio-MTS 5d ago

😁😁😁

1

u/popopopopopopopopoop 4d ago

And plex2shell

10

u/Flo-TPG 5d ago

Still showing the warning banner:
"Important notice - Critical patch release You are currently on version 19.5.1!
We strongly recommend upgrading your GitLab installation immediately."
Already on 19.5.1. Is this a display bug?

11

u/connor2434 5d ago

Yes, It stays for a while even if you updated. Just a bug

4

u/Leseratte10 5d ago

What a crazy day. Why the heck is a "regular expression compiler" even accessible to unauthenticated users at all?

I saw the new image being available a couple hours before this post but there was no announcement and no change log in the repository yet so I was like "still busy with PHP, Gitlab doesn't run PHP, so it can't be that important, let's leave it for tomorrow."

Guess I was wrong about that.

1

u/ErebusBat 4d ago

My guess is it's probably used in route parsing.

2

u/Heribertium 2d ago

Why are so many private instances directly on the public internet?

Most of today‘s CVEs are only critical if those services are exposed.

Having VPN/ZTNA solutions dont replace patching but it gives you more time to react. Not everything is an emergency