GitLab RCE flaw patched, CVE-2026-105437
CERT-FR advises patching a remote code execution vulnerability in GitLab CE/EE versions before 19.3.8, 19.4.6, and 19.5.4.
Sourcecert.cyber.gouv.fr — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT-FR issued an advisory regarding a vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE) that allows an attacker to achieve arbitrary remote code execution. The affected versions include all releases prior to 19.3.8, 19.4.6, and 19.5.4, indicating the flaw spans multiple release branches of the software.
The vulnerability is tracked as CVE-2026-105437. GitLab published a security bulletin on 10 November 2026 with patches available for the affected branches. No details on active exploitation in the wild were provided in the advisory. Organizations running self-managed GitLab instances should prioritize updating to the fixed versions referenced in the vendor's patch release notes to mitigate the risk of remote code execution.
Mentioned in this report
Detection guidance
GitLab Application Process Spawning Shell With Reverse-Shell or Download-and-Execute Pattern
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
GitLab embedded Ruby/Puma/Sidekiq processes spawning a shell with reverse-shell or pipe-to-shell command lines, a likely post-exploitation sign of a GitLab RCE such as CVE-2026-105437. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: GitLab Application Process Spawning Shell With Reverse-Shell or Download-and-Execute
Pattern
description: Detects shells spawned by GitLab's embedded application stack (Puma,
Sidekiq, Rails under /opt/gitlab/embedded) whose command line carries reverse-shell
or pipe-to-shell patterns. This is generic post-exploitation behaviour for a GitLab
RCE such as CVE-2026-105437. The advisory gives no exploit details, so the rule
keys on the result of exploitation rather than the exploit itself.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059.004
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|contains: /opt/gitlab/embedded/
selection_child:
Image|endswith:
- /sh
- /bash
- /dash
selection_cmd:
CommandLine|contains:
- /dev/tcp/
- bash -i
- nc -e
- ncat -e
- base64 -d
- '| sh'
- '| bash'
- mkfifo
condition: selection_parent and selection_child and selection_cmd
falsepositives:
- Administrator-defined GitLab hooks or integrations that legitimately pipe downloaded
scripts into a shell
- Custom GitLab server-side hook scripts that use base64 decoding
level: medium
id: f813f25e-a1e6-56b7-9e99-4036076b3546
status: experimental
author: Vorant
references:
- https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1520
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1520
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs