CISA • 7w
GitLab Remediation of Critical RCE and Information Disclosure Vulnerabilities
GitLab released patch 18.10.3 to address a cluster of critical vulnerabilities, including CVE-2026-1606 and CVE-2026-3074, affecting both Community (CE) and Enterprise (EE) editions. These flaws enable Remote Code Execution (RCE) and significant information disclosure, primarily via code injection vectors within the GitLab Snippets feature and unauthenticated API endpoints. Successful exploitation allows attackers to achieve full system takeover, exfiltrate sensitive source code, and access stored credentials. This marks a shift from historical unauthenticated RCEs to more complex injection flaws requiring immediate version upgrades and rigorous auditing of snippet usage patterns to prevent unauthorized system access.
Links:CISA All Advisories, SecurityWeek, Gitlab-org, Sqmagazine, Hkcert, Docs, Sentinelone, Cyberpress, Rapid7, Rescana, Cve, Socdefenders, Securityaffairs, Thehackernews, Nvd •