Summary
GitLab released emergency patches for 11 vulnerabilities, including two critical regex-related flaws (CVE-2026-89078 and CVE-2026-93577) that allow authenticated attackers to execute arbitrary code on self-managed servers.
Take Action:
If you run your own GitLab server, update it to version 19.4.1, 19.3.3, or 19.2.7. Two critical flaws allow any logged-in user take over the whole server. After updating, check your .gitlab-ci.yml files for new or strange-looking regular expressions, and review who has access to your projects in case someone already tried to exploit this. GitLab.com and GitLab Dedicated users don't need to do anything.
Read the full article on BeyondMachines
This article was originally published on BeyondMachines
Top comments (0)