Public PoC Exposes Silent RCE in GitLab: CVE-Free Flaw Leaves Corporate Servers Exposed
Researchers from depthfirst published functional exploit code for RCE in GitLab on July 25, six weeks after it was patched without a CVE or security note. Any user with push access can compromise the server.
The Exploit and What It Does
Researchers from depthfirst published functional exploit code for a remote code execution vulnerability in GitLab on July 25, 2026. The exploit executes commands as the git user on any self-managed server running version 18.11.3 that hasn't applied the June 10 patch. It does not require administrative rights, access to CI/CD pipelines, runner permissions, or interaction from a maintainer: any authenticated user with push permission for a single project, the access level that any developer in an open repository already has by default, has enough to trigger the full chain.
The attacker commits a specially crafted Jupyter notebook and opens the review diff in GitLab, an operation that leaks a heap pointer from the server. Controlled repetitions allow an automated probe to map the libraries loaded in memory. Two additional notebooks trigger the payload. The technique does not rely on vulnerabilities in the kernel or host operating system, but rather on predictable behavior of the Oj library when processing specific nested JSON content diffs. The absence of victim-side interaction, such as clicking a link, approving a merge request, or opening a file, is the attribute that elevates the risk in corporate environments with many external collaborators.
Why There Is No CVE and What It Means
GitLab fixed the Oj library to version 3.17.3 in the June 10 release, but recorded the change as a common bug fix, not a security update. No CVE was issued. The update was not included in the security fixes table for versions 18.11.4 and 18.11.5. The practical outcome: patch management teams relying solely on alerts with CVSS scores had 45 days to apply a fix that did not signal urgency, while depthfirst prepared the functional proof-of-concept.
The company chose to publish the exploit without prior coordination with the vendor. The justification is straightforward: the patch had been available for six weeks, and the reasonable remediation window had expired without GitLab publicly classifying the risk. As of this report's closing, GitLab had not issued a specific security note regarding the depthfirst exploit, which also means that CVE-based vulnerability scanners do not identify the outdated server as vulnerable.
Global Risk Scope
According to research by Cycode using Shodan data, more than 40,000 self-managed GitLab servers are directly accessible on the internet. This number represents only the publicly exposed instances; the universe of servers protected by VPNs, internal networks, and reverse proxies is considerably larger. The self-managed model is predominant in regulated sectors such as finance, healthcare, and defense, where internal policies prohibit using SaaS instances. These environments tend to have patching cycles measured in weeks, tied to monthly maintenance windows, not hours.
The risk is not limited to American organizations. IT consultancies in India, Germany, and Brazil often host self-managed instances for client projects, frequently in shared development environments. A compromised server in this model can simultaneously expose source code, environment variables, and CI/CD tokens for multiple projects and clients. The low access threshold, push permission for any repository in the instance, significantly increases the attack surface in organizations with hundreds of external collaborators.
What to Do Now
The fix exists and is straightforward: update to 18.10.8, 18.11.5, or 19.0.2. All three versions include the fix for the Oj library 3.17.3. Environments protected by reverse proxies, VPNs, or Web Application Firewalls remain vulnerable if an attacker has valid credentials from any user with push permission, whether through phishing or credential stuffing on repositories with external contributions.
The absence of a CVE cannot serve as a justification for postponing the patch. The depthfirst exploit has been public since July 25 and works against any outdated instance. The window between the publication of a PoC and the start of active exploitation by less sophisticated actors is typically measured in days, not weeks. Teams with monthly or quarterly maintenance cycles should evaluate emergency patching outside of the standard schedule.