Critical RCE Vulnerability in GitLab CE and EE
GitLab Community Edition and Enterprise Edition
GitLab released versions fixing a critical vulnerability that allows unauthenticated remote code execution on the server. Administrators should upgrade self-managed instances immediately.
why this severityA critical rating with a fix supplied by the vendor.
- fix status
- Patched
- affected
- GitLab CE/EE prior to 19.4.2, 19.3.4, and 19.2.8
- fixed in
- GitLab 19.4.219.3.419.2.8
- first report
- 27 Oct 2026
- last update
- 27 Oct 2026
What to do
Upgrade self-managed GitLab CE and EE instances to 19.4.2, 19.3.4, 19.2.8 or later.
Timeline · 1
Sources · 1
Advisories and databases
- 2026-10-272026-016: Critical Vulnerability in GitLab CE and EECERT-EU · cert.europa.eu/publications/security-advisories/2026-016
Titles and links belong to their publishers. The summary above is written by gcdRadar in its own words; data is CC BY-SA 4.0.
Classification
- lane
- Patch now
- AI role
- No AI role
- categories
- General security
- severity
- 2 · Disclosed vulnerability
- fix status
- Patched
- targets
- Not applicable
- owasp llm top 10
- no entry for these categories
- mitre atlas
- no technique for these categories
- dates
- happened 12 Oct 2026 · first reported 27 Oct 2026
- origin
- News & research feeds
- record
- confidence 0.95 · created 2026-10-27 15:31Z · updated 2026-11-11 00:12Z
Lane, AI role, categories and severity come from the classifier; the OWASP and ATLAS rows are derived from the categories. How these are assigned
Copy a brief
This record as a short Markdown brief, for a ticket, a chat or a coding agent.
the brief as text
# Critical RCE Vulnerability in GitLab CE and EE https://gcdradar.vercel.app/incidents/critical-rce-vulnerability-in-gitlab-ce-and-ee · AIR-2026-1574 · closed 2026-11-10 - Lane: Patch now - Severity: 2 (Disclosed vulnerability): A critical rating with a fix supplied by the vendor. - Fix status: Patched - First reported: 2026-10-27 (happened 2026-10-12) - AI role: No AI role - Products: GitLab Community Edition and Enterprise Edition ## Summary GitLab released versions fixing a critical vulnerability that allows unauthenticated remote code execution on the server. Administrators should upgrade self-managed instances immediately. ## What to do Upgrade self-managed GitLab CE and EE instances to 19.4.2, 19.3.4, 19.2.8 or later. ## Affected and fixed versions - Affected: GitLab CE/EE prior to 19.4.2, 19.3.4, and 19.2.8 - Fixed in: GitLab 19.4.2 - Fixed in: 19.3.4 - Fixed in: 19.2.8 ## Latest updates - 2026-10-27: 2026-016: Critical Vulnerability in GitLab CE and EE (https://cert.europa.eu/publications/security-advisories/2026-016) ## Sources - 2026-10-27 CERT-EU: 2026-016: Critical Vulnerability in GitLab CE and EE https://cert.europa.eu/publications/security-advisories/2026-016 Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.
Related
- liveDixell refrigeration units Multiple vulnerabilities discovered in Dixell refrigeration units
Patch now · Exploited · since 13 Nov 2026
- live8.6UnrealIRCd CVE-2026-114713: UnrealIRCd improper neutralization of delimiters vulnerability
Patch now · Exploited · Partly patched · since 13 Nov 2026 · CVE-2026-114713
- liveCity of Osaka municipal systems City of Osaka suffers data breach impacting one million residents
Breaches & attacks · Real loss · since 13 Nov 2026
- liveUniversity of Texas at Arlington discloses data breach from cyberattack
Breaches & attacks · Exploited · since 13 Nov 2026
- livePDF viewers Genuine PDF Forgeries: Attacking Signature Verification via Human Factors
Research · since 13 Nov 2026
- liveAMD SEV-SNP Mior and Skyfall Attacks Target AMD SEV-SNP VMs
Research · since 13 Nov 2026