GitLab hit by CVSS 10.0 unauthenticated RCE, patches shipped for releases back to 2014
jd_pressman · x · 2026-10-22
GitLab has issued a critical patch for CVE-2026-110264 (CVSS 10.0): an unauthenticated remote code execution vulnerability affecting self-managed GitLab servers, potentially impacting releases going back 12 years to 2014.
Patched versions 19.5.1 / 19.4.3 / 19.3.6 / 19.2.9 / 19.1.9 / 19.0.10 / 18.11.13 were released on October 21, 2026 for both CE and EE. All self-managed installations are urged to upgrade immediately. GitLab.com already runs the patched version, and GitLab Dedicated tenants on 19.3.5-internal0 / 19.4.2-internal0 or later need no action.
Related event: GitLab Patches Critical CVSS 10.0 Unauthenticated RCE Flaw(2 posts)→
More from Safety
- US states restrict retinal images as PII, threatening medical AI research — pearsekeane · 2026-10-22
- Generator Residency pays $8,500/month for a 3-month AI safety program in Berkeley — alexcovo_eth · 2026-10-22
- GoDaddy revokes 404,607 TLS certificates after mismatch flagged; 177k still pending — natesiggard · 2026-10-22
- Former FTC Chair Lina Khan calls today's AI exceptionalism "ludicrous" in AI governance talk — AINowInstitute · 2026-10-22
- Constitutions for the multiagent era: how AI constitutions can govern agent organizations — sethlazar · 2026-10-22
- CVE batch disclosure is like a 17-year cicada emergence, researcher argues — moultano · 2026-10-22