Critical GitLab Flaw Enables Remote Code Execution

Security researchers have published proof-of-concept exploit code for a remote code execution vulnerability affecting multiple versions of self-managed GitLab, sharply increasing the urgency for organizations that have not installed patches released in June 2026.

The exploit chain allows an authenticated GitLab user with permission to commit changes to a project to execute operating-system commands on the underlying server. Successful commands run under the git service account used by GitLab’s Puma application workers.