Over a Thousand GitLab Servers Still Unpatched Against Critical RCE Vulnerability

More than a thousand GitLab servers that are publicly accessible on the Internet have been discovered by security researchers to remain unpatched against a critical remote code execution (RCE) flaw that attackers are already exploiting.

Rated as maximum severity by the Common Vulnerability Scoring System, the bug enables an attacker to execute arbitrary commands on the compromised host merely by issuing specially crafted requests to GitLab’s web interface. Although the initial disclosure omitted the specific CVE number, the issue bears a CVSS rating of 10.0, the top possible risk level.

GitLab serves as a popular solution for source‑code management, continuous integration, and DevOps workflow automation. Numerous enterprises run self‑hosted GitLab instances instead of the cloud offering, frequently making the web UI reachable from the public Internet to enable remote teamwork. Such ease of access turns risky if essential patches are not installed quickly.

Those figures arise from a methodical scan performed by the cybersecurity publication that initially uncovered the problem. Investigators probed public IP blocks for GitLab deployments that matched known version fingerprints, then compared the discovered versions with the vendor’s advisory database. Any server still operating a version older than the most recent security patch was marked as vulnerable, yielding a total exceeding 1,000 exposed installations.

If exploited, the flaw can grant attackers complete control of the compromised server, permitting them to pilfer source code, embed malicious payloads into CI pipelines, and move laterally into associated systems. Because GitLab is pivotal in software development, such a breach could trigger supply‑chain attacks that impact downstream consumers of the tainted code.

Security professionals advise administrators to make the upgraded GitLab release a top priority, implement rigorous network segmentation, and contemplate positioning the service behind a VPN or firewall that restricts access to trusted IP ranges. If an immediate upgrade isn’t possible, short‑term mitigations—like disabling the vulnerable endpoints and applying the vendor’s workarounds—can lessen the risk.

GitLab’s development team has published a security advisory and released the required patches. Yet the continued existence of unpatched installations highlights a wider issue: maintaining up‑to‑date self‑hosted infrastructure amid a rapidly evolving threat environment. Continuous monitoring, automated patch rollout, and periodic vulnerability assessments are expected to become standard guidance as firms aim to bridge the gap before threat actors can exploit the flaw further.