Critical GitLab Vulnerability - 2026

On October 15, 2026, GitLab released critical security advisories addressing multiple severe vulnerabilities across its Community Edition (CE) and Enterprise Edition (EE) instances, most notably CVE-2026-11589 (CVSS 9.6) and CVE-2026-11590 (CVSS 8.8). The most dangerous flaw, CVE-2026-11589, allows an unauthenticated remote attacker to bypass SAML authentication and achieve account takeover on instances configured with SAML Single Sign-On (SSO). This vulnerability stems from improper XML signature validation during the assertion processing phase, enabling attackers to forge valid authentication tokens and hijack high-privilege accounts without needing valid credentials.

Alongside authentication bypasses, the October release resolves CVE-2026-11590, a critical Remote Code Execution (RCE) vector in GitLab's Continuous Integration (CI/CD) runner pipeline parser. By exploiting unsafe variable expansion in custom .gitlab-ci.yml configurations, an authenticated project collaborator can inject shell commands that execute directly within the runner's underlying host environment or shared container runner context. This allows malicious actors to access private project repositories, compromise internal network resources, and siphon confidential deployment secrets such as SSH keys and cloud API credentials stored within pipeline environment variables.

To mitigate these risks, GitLab administrators must urgently upgrade self-hosted instances to the patched versions: 17.4.2, 17.3.5, or 17.2.9. For instances where immediate upgrading is not feasible, organizations should temporarily disable SAML SSO authentication, enforce mandatory multi-factor authentication (MFA) via internal identity providers, and restrict runner execution permissions. Following the system patch, administrators should audit user sign-in logs and runner job execution histories to detect potential pre-patch exploitation or unauthorized persistent access within their CI/CD environments.