Act
archived
GitLab RCE PoC Published: Authenticated Users Can Execute Commands as Git
- Engineer — Act: A working public exploit now exists for this six-week-old GitLab flaw; any authenticated user with push access on an unpatched self-managed instance can achieve RCE. Upgrade to the patched version released June 10 immediately and verify no self-managed GitLab instances remain on 18.11.3.
- SOC/IR — Act: PoC publication on July 24 makes exploitation imminent; hunt for anomalous Jupyter notebook pushes followed by commit-diff access on self-managed GitLab instances, and look for unexpected git-process child execution in EDR telemetry as of that date.
- Leader — Plan: A public exploit for GitLab RCE elevates CI/CD pipeline compromise risk this week; confirm with engineering that all self-managed GitLab instances are on the June 10 patched release before this becomes an active incident requiring notification.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.