# GitLab RCE flaw patched, CVE-2026-105437

Published: 2026-11-12 · Severity: routine · Sectors: Technology
Canonical: https://vorant.io/reports/02849006-d29d-5ca0-89f5-13bc633283b6/gitlab-rce-flaw-patched-cve-2026-105437
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> CERT-FR advises patching a remote code execution vulnerability in GitLab CE/EE versions before 19.3.8, 19.4.6, and 19.5.4.

Source: cert.cyber.gouv.fr — https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1520

## What to check

- Applies to: The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation: No exploitation in the wild and no public exploit is recorded for the CVEs named.

CERT-FR issued an advisory regarding a vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE) that allows an attacker to achieve arbitrary remote code execution. The affected versions include all releases prior to 19.3.8, 19.4.6, and 19.5.4, indicating the flaw spans multiple release branches of the software.

The vulnerability is tracked as CVE-2026-105437. GitLab published a security bulletin on 10 November 2026 with patches available for the affected branches. No details on active exploitation in the wild were provided in the advisory. Organizations running self-managed GitLab instances should prioritize updating to the fixed versions referenced in the vendor's patch release notes to mitigate the risk of remote code execution.

## Mentioned in this report

- Vulnerabilities: CVE-2026-105437

## Detection guidance (public sample)

### GitLab Application Process Spawning Shell With Reverse-Shell or Download-and-Execute Pattern

ATT&CK: T1190

A behavioural hunt for the technique in general, not a signature for the CVEs this report names. Needs linux process_creation logs. Status: experimental. Generated from the report; not run against telemetry.

GitLab embedded Ruby/Puma/Sidekiq processes spawning a shell with reverse-shell or pipe-to-shell command lines, a likely post-exploitation sign of a GitLab RCE such as CVE-2026-105437. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: GitLab Application Process Spawning Shell With Reverse-Shell or Download-and-Execute
  Pattern
description: Detects shells spawned by GitLab's embedded application stack (Puma,
  Sidekiq, Rails under /opt/gitlab/embedded) whose command line carries reverse-shell
  or pipe-to-shell patterns. This is generic post-exploitation behaviour for a GitLab
  RCE such as CVE-2026-105437. The advisory gives no exploit details, so the rule
  keys on the result of exploitation rather than the exploit itself.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains: /opt/gitlab/embedded/
  selection_child:
    Image|endswith:
    - /sh
    - /bash
    - /dash
  selection_cmd:
    CommandLine|contains:
    - /dev/tcp/
    - bash -i
    - nc -e
    - ncat -e
    - base64 -d
    - '| sh'
    - '| bash'
    - mkfifo
  condition: selection_parent and selection_child and selection_cmd
falsepositives:
- Administrator-defined GitLab hooks or integrations that legitimately pipe downloaded
  scripts into a shell
- Custom GitLab server-side hook scripts that use base64 decoding
level: medium
id: f813f25e-a1e6-56b7-9e99-4036076b3546
status: experimental
author: Vorant
references:
- https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1520
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1520

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/02849006-d29d-5ca0-89f5-13bc633283b6/gitlab-rce-flaw-patched-cve-2026-105437.
In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup