CVE-2026-112212: Critical flaw could let anyone with no account hack companies' GitLab servers

Not listed so far in CISA’s catalog of actively exploited vulnerabilities.

Our analyses

Critical flaw could let anyone with no account hack companies' GitLab servers

On October 21, GitLab released patches for a flaw present in every version since 7.0. No attacks have been reported so far. Here are the versions to install and the signs to watch for.

Oct 23, 20262 min read

What to do

Check whether your estate includes the affected product, including internet-facing devices.
Apply the vendor’s patch or mitigations (references below).
Watch for exploitation: this entry is updated if the vulnerability enters the exploited catalog or is the subject of a CERT-FR alert.

References

NVD entry (NIST)