Plan
active
Critical GitLab Unauthenticated RCE Affects All Releases Since 2014
- Engineer — Plan: If you run self-managed GitLab, apply the October 21 release immediately — the October 12 patch only covered 19.2+ and left older versions fully exposed to unauthenticated RCE. No KEV or public PoC is confirmed yet, but CVSS 10.0 with universal version coverage warrants patching ahead of your normal window.
- SOC/IR — Skip
- Leader — Plan: Confirm your engineering team has applied the October 21 GitLab patch, not just the October 12 one — a widespread false sense of being patched exists for self-managed deployments, and unauthenticated RCE on source-code infrastructure would be a material incident if exploited.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.