A flaw in GitLab, the software many teams use to store code and run their build pipelines, has been patched after being rated as severe as a vulnerability can be. It allows someone to run code on a server without first logging in, which is the kind of opening that makes defenders uneasy because it removes the usual barrier of credentials. Reports say the weakness may have sat inside the software for twelve years, a reminder that the systems we trust most can carry old problems unnoticed. For organizations running their own GitLab, the work now is to update and to check whether anyone got in be
Critical GitLab Flaw (CVSS 10.0) Allows Unauthenticated Code Execution Across 12 Years of Releases
A flaw in GitLab, the software many teams use to store code and run their build pipelines, has been patched after being rated as severe as a vulnerability can be. It allows someone to run code on a server without first logging in, which is the kind of opening that makes defenders uneasy because it removes the usual barrier of credentials. Reports say the weakness may have sat inside the software for twelve years, a reminder that the systems we trust most can carry old problems unnoticed. For organizations running their own GitLab, the work now is to update and to check whether anyone got in before the fix arrived.
GitLab has patched a vulnerability that security trackers rate at 10.0 on the CVSS scale, the highest score the system allows. The flaw, catalogued as CVE-2026-110264, reportedly lets an attacker run code on a vulnerable server without logging in first.
The headlines from several outlets describe the same core problem: an unauthenticated remote code execution flaw affecting self-managed GitLab servers, the installations organizations run on their own infrastructure rather than on GitLab's hosted service. The detail drawing the most attention is the age of the bug. Reporting says it spans 12 years of releases, so a long run of versions could carry the weakness and many installations may have been exposed for much of that time.
The score and the lack of authentication are what make this serious. A 10.0 rating generally signals a network-reachable attack that takes little effort and can do heavy damage. Because no login is needed, an attacker never has to steal a password first, and that matters a great deal for a platform that often holds source code, build pipelines and credentials.
Much remains unknown. The material does not say whether anyone exploited the flaw before the patch, how many servers are exposed, how the attack works, or which versions are affected. The 12-year figure is reported rather than independently confirmed.
The practical advice is clear. Self-managed operators should apply the patch promptly and look for signs of compromise, since an old flaw may have been abused before a fix existed. Watch for GitLab's own advisory to define affected and patched versions, and for any researcher reports on attacks seen in the wild.
GitLab has patched a vulnerability that security trackers rate at 10.0 on the CVSS scale, the highest score the system allows. The flaw is catalogued as CVE-2026-110264, and according to the reports collected around it, it lets an attacker run code on a vulnerable server without logging in first.
The headlines from several outlets, including The Hacker News, CyberSecurityNews, SecNews.gr, Startup Fortune and news.lavx.hu, all describe the same thing: an unauthenticated remote code execution flaw, fixed by GitLab. The affected systems are self-managed servers, meaning installations that organizations run on their own infrastructure rather than on GitLab's hosted service.
The detail that has drawn the most attention is the age of the problem. The reporting says the flaw spans 12 years of releases. Taken at face value, that means a very long run of GitLab versions could carry the weakness, and many self-managed installations may have been exposed for some or all of that time. The material available does not say how the bug was found, who reported it, or which version numbers are affected and which contain the fix.
The two things that make this serious are the score and the lack of authentication. A CVSS 10.0 rating generally signals that an attack can be launched over a network, requires little effort, and can badly damage the affected system. Needing no login means an attacker does not first have to steal a password or compromise an account. For a platform that typically holds source code, build pipelines and credentials, that is a significant exposure.
What is not established in the source material matters just as much. There is no statement here about whether anyone exploited the flaw before the patch, no count of exposed servers, and no technical explanation of how the attack works. The reporting is a set of headlines pointing to the fix, not a detailed forensic account, and the 12-year figure is described as reported rather than independently confirmed in what we have.
The practical advice that follows is straightforward. Operators of self-managed GitLab should apply the patch promptly, and they should also look for signs that their servers were compromised, since a flaw this old could have been abused before a fix existed. Organizations using GitLab's hosted service are not the focus of the coverage.
What to watch next is GitLab's own advisory, which should spell out the affected versions and the patched releases, and any follow-up from security researchers on whether attacks have been seen in the wild.
Vuoi la storia completa?
Leggi l'originale su Google News ↗
Business