GitLab Discloses 12-Year-Old CVSS 10.0 Vulnerability Enabling Unauthenticated Remote Code Execution
GitLab has disclosed a CVSS 10.0 vulnerability, CVE-2026-110264, that enables unauthenticated remote code execution on self-hosted instances. The flaw has remained present in both Community and Enterprise editions for twelve years, dating back to the platform’s early releases in 2014.
Impact and Exploitation
The maximum CVSS score reflects an extremely low attack threshold: an adversary needs only network access to the GitLab server to execute arbitrary commands. Attackers can download repositories, implant persistent backdoors, perform lateral movement, or deploy ransomware without any authentication.
Comparisons with prior critical issues highlight the severity. The 2021 Log4Shell vulnerability also scored 10.0 but required log interaction, while the 2024 MOVEit Transfer flaw scored 9.8 and needed additional preconditions. In contrast, the GitLab issue needs no special steps beyond reaching the server.
Why the Vulnerability Persisted
GitLab’s extensive codebase, exceeding one million lines and encompassing code hosting, CI/CD pipelines, issue tracking, wikis, and container registries, makes comprehensive auditing difficult. The flaw arises from subtle logic errors across multiple modules rather than an obvious coding mistake, evading routine testing and security reviews.
Resource constraints on open-source projects further limit deep historical code analysis, allowing the defect to survive repeated updates until the October 2026 patch.
Immediate Actions for Administrators
- Verify the current GitLab version against the advisory and upgrade to the patched release.
- Examine access logs for suspicious IP addresses, off-hour activity, and unauthorized API calls.
- Inspect administrator accounts, repository commits, and CI/CD pipelines for signs of compromise.
Self-hosted deployments often contain proprietary source code, configuration files, and secrets, making rapid response essential.
Temporary Mitigations
When immediate upgrades are impractical, organizations should restrict access via firewalls or WAF rules to approved internal or whitelisted IPs, deploy additional process and network monitoring, maintain verified backups, and enforce least-privilege access with mandatory multi-factor authentication for administrators.
Industry Implications
The incident underscores that security in large, long-lived software projects is an ongoing process rather than a one-time task. Regular vulnerability management, continuous code auditing, and timely patch application remain critical responsibilities for any organization running self-hosted GitLab instances.
Related articles
Researchers Disclose Full Remote Vehicle Takeover Chain in Major Automaker Connected Platform
Security researchers Shubs and Sam Curry discovered a complete attack chain allowing remote control of any connected vehicle from a major undisclosed automaker across Australia and other large markets. The chain began with decompiled Android APK analysis that revealed hardcoded API endpoints under redacted-telematics.com.au and exposed administrative interfaces. Weak access controls in an OpenIDM instance permitted unauthenticated enumeration of user accounts via email, GUID, and phone number lookups. Path traversal bypasses combined with leaked staging credentials granted administrative access to ForgeRock OpenIDM, enabling password resets and full account takeover. Researchers further bypassed MFA using Resource Owner Password Credentials flows and obtained valid mobile application tokens. With these tokens they could issue arbitrary remote commands including unlock, lock, horn activation, and engine start to any vehicle by VIN or license plate.
Nightmare Eclipse Publishes SignDrop Zero-Day in Windows CLFS Driver
Security researcher Abdelhamid Naseri, known as Nightmare Eclipse, has disclosed a new zero-day vulnerability named SignDrop affecting the Common Log File System (CLFS) driver in Windows. The flaw allows attackers to bypass authentication protections introduced by Microsoft in October 2025 and escalate privileges on affected systems. SignDrop exploits the way CLFS handles .cnpf authentication file creation when a new log file is generated, enabling a privileged process to open the file later and create it with SYSTEM rights. The technique can also be abused against any antivirus or EDR engine to disable self-protection mechanisms by making file creation requests appear to originate from the legitimate security process itself. Nightmare Eclipse confirmed the issue works on Windows 11 26H2, Windows 11 26H2 Experimental, and Windows Server 2025 Experimental, impacting an estimated 80 percent of Windows installations. No workaround exists other than waiting for a Microsoft patch, as disabling CLFS protections would reintroduce memory corruption risks. The researcher previously released multiple other zero-days, including BigDiskBuster and RoguePlanet targeting Microsoft Defender.
Telegram Patches RCE Vulnerabilities in HTML Widgets After Researcher Demonstrates Calculator Exploit
Telegram introduced HTML widgets for bots in early November, allowing JavaScript execution inside messages via the QuickJS engine. Security researcher V12 quickly demonstrated remote code execution by launching the system calculator on Android. Pavel Durov responded that no vulnerability existed because the user had to first start the bot, yet server-side fixes were deployed anyway. Multiple use-after-free and use-after-return bugs were identified in QuickJS and QuickJS-ng, some discovered with AI assistance from Claude Fable 5.1 and Mythos 5.2. Telegram isolated the widget engine into a separate process on Android, added syscall filtering, and limited nested graphical effects to prevent crashes. Desktop clients received the fixes across versions 7.4.2 and 7.4.3, while widgets were temporarily restricted server-side. Users are advised to update to Android 13.2.2 or Desktop 7.4.3 and avoid unknown bots.
Telegram Patches Critical QuickJS Sandbox Escape Vulnerability in Android Update 13.2.2
Telegram has released version 13.2.2 for Android to address a high-severity vulnerability in its HTML widgets for bots. The flaw resided in the QuickJS JavaScript engine within Telegram's QuickJS-ng fork and allowed scripts in ordinary messages to break out of the sandbox and execute native code on the device. The root cause was improper handling of the await using construct inside non-async functions, which triggered a use-after-return condition by freeing local variable references while nested functions still accessed the stack. The vulnerable code entered the QuickJS-ng main branch on May 16 as part of explicit resource management support. Security researcher Andreas Rösler discovered the issue during an AI-assisted audit with Anthropic's Claude model that identified 27 findings total. The patch enforces a syntax error on the invalid construct and was merged on November 10, the same day the Android release became available. Although reported against Android 13.2.1, the bug affected every platform using the affected engine fork.