● Covered by 3 sources · 11 reportsMedium impact9 negative2 neutral
GitLab RCE PoC Published for Authenticated Users on Unpatched Servers
Key points
- PoC exploit published for GitLab RCE vulnerability.
- Authenticated users can execute commands as git.
- Affects GitLab CE/EE versions 15.2.0-18.10.7, 18.11.0-18.11.4, 19.0.0-19.0.1.
- Fixes available in 18.10.8, 18.11.5, and 19.0.2.
- GitLab released security updates for CVE-2026-19478.
- Unauthenticated attackers can modify or delete public projects and user data via GraphQL.
- The vulnerability is rated 9.4 CVSS.
- The patch was released on August 17, 2026.
- Only self-managed installations need to act.
- Fixes are available in GitLab 19.2.4, 19.1.6, 19.0.8, and 18.11.11.
- Affected versions include 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4.
- Fixes do not extend to 18.2 through 18.10 branches.
- GitLab patched two vulnerabilities.
- The second vulnerability is CVE-2026-19650, a CSRF issue.
- CVE-2026-19650 has a CVSS score of 7.1.
- CVE-2026-19650 impacts GraphQL multiplex query handler.
- Patches were automatically applied to GitLab.com and GitLab Dedicated.
- CVE-2026-19478 was exploited approximately two days after disclosure.
- WatchTowr warned about the flaw on August 18.
- WatchTowr reproduced the vulnerability within minutes of disclosure.
- Mitigation includes restricting unauthenticated access to /api/graphql endpoint.
- The vulnerability is a code injection flaw.
- Exploitation does not require credentials, user interaction, or obscure configuration.
- WatchTowr observed in-the-wild exploitation against its honeypot network.
- CISA warned about active exploitation of CVE-2026-60004.
- CVE-2026-60004 affects Gitea.
- Gitea is an open source, self-hosted software development platform.
- Gitea developers released version 1.27.1 in late July to patch the vulnerability.
- CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog.
- Federal agencies must patch the flaw by August 28.
- The vulnerability allows attackers with repository write access to plant an executable Git hook.
- The flaw allows running shell commands as the Gitea service account.
- Another Gitea flaw, CVE-2026-20896, was exploited in early July.
- CVE-2026-60004 has a CVSS score of 9.8.
- CVE-2026-60004 allows unauthenticated users to gain write access by registering an account.
- Shai rod (NightRang3r) discovered and reported CVE-2026-60004.
- CVE-2026-60004 affects all Gitea versions from 1.17.
- The flaw allows execution of shell commands via the diffpatch API endpoint.
- The flaw allows attackers to plant an executable Git hook from repository-controlled content.
- Over 8,300 internet-exposed Gitea instances are unpatched against CVE-2026-60004.
- Shadowserver reported the number of unpatched Gitea instances.
Remote Code Execution Vulnerability Disclosed
Security researcher Yuhang Wu at depthfirst has released a working proof-of-concept (PoC) exploit for a remote code execution (RCE) vulnerability in unpatched self-managed GitLab 18.11.3 servers. The exploit allows an authenticated user to execute commands as the 'git' user by committing two specially crafted Jupyter notebooks and requesting their diff.
Affected Versions and Impact
The vulnerability impacts GitLab Community Edition (CE) and Enterprise Edition (EE) across several version ranges: 15.2.0 through 18.10.7, 18.11.0 through 18.11.4, and 19.0.0 through 19.0.1. The underlying issues stem from bugs in the Oj JSON parser, affecting published gems 3.13.0 through 3.17.1. Successful exploitation could expose sensitive data such as source code, Rails secrets, service credentials, and CI/CD data, depending on deployment isolation.
Required Actions for Self-Managed Instances
GitLab.com instances were patched by June 10, and dedicated customers do not need to take action. However, operators of self-managed GitLab instances must upgrade to a supported release containing the fix. The first fixed releases are 18.10.8, 18.11.5, and 19.0.2. There is no temporary workaround available; upgrading is the only recommended mitigation. Users of Helm and Operator deployments must verify the GitLab version within the Webservice image, not just the chart or Operator version.
Technical Details and CVE Status
The vulnerability chain involves GitLab's notebook renderer passing repository-controlled .ipynb JSON to Oj::Parser.usual.parse within a Puma worker. This process sends attacker-controlled data into Oj's native parser state. The depthfirst analysis indicates one bug controls a callback pointer, while another leaks a heap address. Neither depthfirst's disclosure nor GitLab's release notes have provided CVE identifiers or CVSS scores for these specific bugs.
Updates
- Over 8,300 internet-exposed Gitea instances are unpatched against CVE-2026-60004.
- Shadowserver reported the number of unpatched Gitea instances.
- The flaw allows execution of shell commands via the diffpatch API endpoint.
- The flaw allows attackers to plant an executable Git hook from repository-controlled content.
- CVE-2026-60004 has a CVSS score of 9.8.
- CVE-2026-60004 allows unauthenticated users to gain write access by registering an account.
- Shai rod (NightRang3r) discovered and reported CVE-2026-60004.
- CVE-2026-60004 affects all Gitea versions from 1.17.
- CISA warned about active exploitation of CVE-2026-60004.
- CVE-2026-60004 affects Gitea.
- Gitea is an open source, self-hosted software development platform.
- Gitea developers released version 1.27.1 in late July to patch the vulnerability.
- CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog.
- Federal agencies must patch the flaw by August 28.
- The vulnerability allows attackers with repository write access to plant an executable Git hook.
- The flaw allows running shell commands as the Gitea service account.
- Another Gitea flaw, CVE-2026-20896, was exploited in early July.
- The vulnerability is a code injection flaw.
- Exploitation does not require credentials, user interaction, or obscure configuration.
- WatchTowr observed in-the-wild exploitation against its honeypot network.
- CVE-2026-19478 was exploited approximately two days after disclosure.
- WatchTowr warned about the flaw on August 18.
- WatchTowr reproduced the vulnerability within minutes of disclosure.
- Mitigation includes restricting unauthenticated access to /api/graphql endpoint.
- GitLab patched two vulnerabilities.
- The second vulnerability is CVE-2026-19650, a CSRF issue.
- CVE-2026-19650 has a CVSS score of 7.1.
- CVE-2026-19650 impacts GraphQL multiplex query handler.
- Patches were automatically applied to GitLab.com and GitLab Dedicated.
- GitLab released security updates for CVE-2026-19478.
- Unauthenticated attackers can modify or delete public projects and user data via GraphQL.
- The vulnerability is rated 9.4 CVSS.
- The patch was released on August 17, 2026.
- Only self-managed installations need to act.
- Fixes are available in GitLab 19.2.4, 19.1.6, 19.0.8, and 18.11.11.
- Affected versions include 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4.
- Fixes do not extend to 18.2 through 18.10 branches.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Primary sources
GitHub wupco/gitlab-rce-demo GitHub ohler55/oj GitHub go-gitea/gitea CVE CVE-2026-600049.8 CRITICAL CVE CVE-2026-505229.8 CRITICAL CVE CVE-2026-59774How outlets covered it
Over 8,300 internet-exposed Gitea instances are unpatched against CVE-2026-60004, a critical code injection vulnerability that allows authenticated attackers to execute arbitrary shell commands. This flaw is actively being exploited, prompting CISA to order federal agencies to patch their systems immediately.
Attackers are actively exploiting a critical code injection vulnerability (CVE-2026-60004) in the Gitea self-hosted Git service, allowing arbitrary shell command execution. The U.S. CISA has added this flaw to its Known Exploited Vulnerabilities catalog, mandating federal agencies to patch their systems within three days due to active exploitation and significant risk.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning about active exploitation of CVE-2026-60004, a critical remote code execution flaw in Gitea. This vulnerability allows attackers with repository write access to execute arbitrary shell commands, and with default open registration, an unauthenticated user can gain the necessary access to exploit it, potentially leading to cryptocurrency miner deployment.
CISA issued a warning about active exploitation of CVE-2026-60004, a Gitea vulnerability allowing remote code execution. This flaw enables attackers with repository write access to inject malicious code and execute shell commands, posing a risk to organizations using the self-hosted development platform.
A critical code injection vulnerability in GitLab, CVE-2026-19478, is under active exploitation just days after its public disclosure. This flaw allows unauthenticated attackers to modify or delete public GitLab projects and rewrite data, highlighting the rapid pace of exploitation for newly revealed vulnerabilities.
A critical GitLab code injection vulnerability (CVE-2026-19478) was exploited in the wild approximately two days after its public disclosure and patching. This flaw allows unauthenticated attackers to modify or delete public projects and user data, posing a significant supply chain risk.
GitLab released patches for two vulnerabilities, including a critical unauthenticated code injection flaw (CVE-2026-19478) and a cross-site request forgery (CSRF) issue (CVE-2026-19650). These patches are important for self-managed GitLab users to prevent potential data modification or deletion by attackers.
GitLab released security updates for its Community and Enterprise Editions to fix a critical vulnerability, CVE-2026-19478, which could allow unauthenticated attackers to modify or delete public projects and user data via GraphQL. This flaw, rated 9.4 CVSS, affects self-managed installations and requires immediate patching to prevent potential data loss or unauthorized changes.
Gitea versions 1.22.1 through 1.27.0 contain a critical vulnerability (CVE-2026-59774) that allows unauthenticated attackers to read server files via crafted Org-mode markup in public repositories. This flaw can be chained to achieve remote code execution, and administrators are urged to upgrade to version 1.27.1 immediately.
Gitea has patched a critical remote code execution (RCE) vulnerability, CVE-2026-60004, that allowed authenticated users with repository write access to execute shell commands on the server. This flaw affects Gitea versions 1.17 through 1.27.0 and is fixed in version 1.27.1, making immediate upgrades crucial for self-hosted instances.
A security researcher published a proof-of-concept exploit for a remote code execution vulnerability in self-managed GitLab servers, allowing authenticated users to run commands as git. This vulnerability affects multiple GitLab Community Edition and Enterprise Edition versions and requires self-managed operators to upgrade to patched releases.