GitLab patches third CVSS 10.0 flaw in six weeks: unauthenticated remote takeover of self-managed servers, every release since 2014 must be upgraded
GitLab patched CVE-2026-110264, a CVSS 10.0 unauthenticated remote-code-execution flaw affecting self-managed servers, the third maximum-severity bug in six weeks. Every self-hosted release since 2014 is affected, including the ones patched on October 12; GitLab says it has seen no sign of exploitation so far, and GitLab.com and Dedicated users need no action. Why it matters: these servers hold source code, deploy keys and CI pipelines, so a takeover could leak secrets or plant backdoors — and this one hit even freshly patched versions, making upgrades urgent.
SOURCES
- 宝玉 (Baoyu)2026-10-21 20:57