GitLab Patches RCE in Package Registry (CVE-2026-10053)

GitLab has shipped security updates patching CVE-2026-10053, an authenticated remote code execution vulnerability in the package registry component of GitLab CE and EE. CVSS 8.5 (High). Self-managed instance operators need to act.

What’s Affected

All GitLab CE/EE self-managed versions from 18.8 up to — but not including — the patched releases:

The flaw allows an authenticated user to achieve RCE through a path traversal vulnerability in the package registry. “Authenticated” is the critical qualifier — you don’t need admin rights. Any account holder on the instance is within the attack surface. GitLab issue 601596 / NVD entry.

GitLab.com is already patched. This only affects self-managed deployments.

What to Do

1. Find your version. Admin Area → Help → GitLab version, or run gitlab-rake gitlab:env:info.
2. Upgrade to the patched release for your branch. GitLab maintains stable minor-version tracks — 19.0.6, 19.1.4, or 19.2.2 depending on where you are.
3. Package registry doesn’t need to be in use. The component is enabled by default. Whether you actively push packages or not, the attack surface is present.
4. Review the full advisory at GitLab’s security release page.

Priority Call

Self-managed GitLab hosts are your CI/CD backbone — source code, build secrets, deployment keys, all in one place. An authenticated RCE here means an attacker with any account on the instance can run arbitrary code on the server. That expands to secrets exfiltration and arbitrary pipeline manipulation. Treat this as a same-day upgrade if you’re on an affected version.

If an immediate upgrade isn’t feasible, consider restricting package registry access while you schedule the maintenance window.

Related coverage: Critical GitLab Flaw Lets Attackers Delete Projects · GitLab RCE PoC Published · GitHub Actions Injection in Snowflake .NET Repo