Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across Twelve Years of Releases
Summary
A critical GitLab flaw (CVE-2026-110264) with CVSS 10.0 could allow unauthenticated remote code execution on self-managed GitLab servers. The vulnerability affects versions going back to 7.0 (2014) and requires patching across multiple release branches; GitLab provides backported fixes and a clear upgrade path. The report also notes detection rules and potential upgrade downtime for some versions, with GitLab.com unaffected.