# GitLab Patches Critical RCE Vulnerability

GitLab disclosed and patched a CVSS 10.0 unauthenticated remote-code-execution vulnerability affecting self-managed Community Edition and Enterprise Edition instances, with exposure dating back to version 7.0. There is no workaround; organizations using an affected supported branch should upgrade to its fixed release, prioritizing internet-facing servers. For procurement teams and contractors, the issue is relevant to the security of software-development environments used to build or support government work, though the signal identifies no solicitation, contract award, or procurement opportunity.

- Organizations running affected self-managed GitLab instances should identify their branch and upgrade to the corresponding fixed release: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, or 18.11.13.
- Contractors and agencies using GitLab in development workflows should determine whether their environments are self-managed and exposed, with particular priority given to internet-facing servers.
- The vulnerability has no workaround, so applying the fixed release is the stated remediation; procurement teams can factor the patch status of relevant development environments into security reviews.

**Jurisdictions:** federal
**Industries:** Information Technology
**Topics:** Cybersecurity
**Published:** October 23, 2026

### Government Entities
- Cybersecurity and Infrastructure Security Agency (CISA)

### Vendors
- GitLab ()

### Sources
- [GitLab patches maximum-severity flaw dating back to 2014](https://gcn.com/gitlab-patches-maximum-severity-flaw/22707) - gcn.com