CERT-EU 2026-10-12

2026-016: Critical Vulnerability in GitLab CE and EE

Machine-generated analysis · WAYSCloud LLM

GitLab CE and EE versions before 19.4.2, 19.3.4, and 19.2.8 have a critical unauthenticated code execution vulnerability.

Context

The advisory concerns self-managed GitLab Community Edition and Enterprise Edition. It notes that a critical flaw could let an unauthenticated attacker execute arbitrary code on the server, and that GitLab released patched versions 19.4.2, 19.3.4, and 19.2.8 fixing 24 issues. CERT-EU recommends upgrading, prioritizing internet-facing instances.

Operator considerations

Check: inventory GitLab installations and verify their version.
Patch: upgrade any instance running a version earlier than the fixed releases to 19.4.2, 19.3.4, or 19.2.8.

From Computer Emergency Response Team for the EU institutions ↗

On 12 October 2026, GitLab released versions 19.4.2, 19.3.4 and 19.2.8 of GitLab Community Edition (CE) and Enterprise Edition (EE), fixing 24 security issues among which a critical vulnerability that could allow an unauthenticated attacker to execute arbitrary code on the server.

CERT-EU strongly recommends upgrading self-managed GitLab CE/EE instances to a fixed version as soon as possible, starting with internet-facing instances.

Read the full advisory on CERT-EU →