Over a Thousand GitLab Servers Still Open to Critical Remote Code Execution Vulnerability

More than a thousand GitLab instances that are publicly accessible on the Internet have been discovered by security researchers to still be missing patches for a critical remote‑code‑execution (RCE) flaw that attackers are already exploiting.

Rated at the highest severity level by the Common Vulnerability Scoring System, the bug enables a threat actor to execute any command on the compromised machine merely by issuing specially crafted requests to GitLab’s web UI. The initial disclosure omitted the specific CVE number, but the issue scores a perfect 10.0 on the CVSS scale, signifying maximal risk.

GitLab serves as a popular tool for source‑code management, continuous integration, and DevOps automation. A substantial number of enterprises run self‑hosted GitLab installations instead of the cloud offering, frequently making the web interface reachable from the public Internet to support remote teamwork. Such accessibility turns into a risk when essential patches are not applied without delay.

Those figures arise from a methodical scan carried out by the security publication that initially broke the story. Investigators probed public IP blocks for GitLab deployments that matched known version fingerprints, then compared the discovered versions with the vendor’s advisory database. Any server still operating on a version older than the most recent security patch was marked as vulnerable, producing a total exceeding 1,000 exposed instances.

If exploited, the flaw grants attackers complete command over the targeted server, allowing them to exfiltrate source code, embed malicious payloads into CI pipelines, and move laterally to other linked systems. Because GitLab sits at the heart of many software development workflows, such a compromise could trigger supply‑chain attacks that impact downstream consumers of the tainted code.

Security professionals recommend that administrators make the updated GitLab version their top priority, implement rigorous network segmentation, and contemplate situating the service behind a VPN or firewall that restricts access to approved IP ranges. If an immediate upgrade isn’t possible, interim mitigations—like disabling the vulnerable endpoints and applying the vendor’s suggested workarounds—can lessen the risk.

GitLab’s development team has published a security advisory and released the required patches. Yet the continued existence of unpatched installations highlights a wider issue: maintaining up‑to‑date self‑hosted infrastructure amid a rapidly evolving threat environment. Continuous monitoring, automated patch rollout, and periodic vulnerability scans are set to become commonplace advice as firms aim to seal the gap before adversaries can further exploit the flaw.