A Critical Vulnerability in GitLab Has Been Actively Exploited, Putting Millions of Users at Risk
GitLab, a widely-used platform for software development and collaboration, has been hit with a critical vulnerability that allows attackers to read sensitive files on compromised accounts. The flaw, given a CVSS (Common Vulnerability Scoring System) rating of 10 – the highest severity level – has been actively exploited in the wild, putting millions of users at risk.
The vulnerability, which affects GitLab version 14.9 and earlier, is a file-read bug that allows attackers to access sensitive files on compromised accounts using a cross-domain privilege escalation technique. This means that an attacker can gain access to files that are not publicly accessible by exploiting the flaw in a way that takes advantage of differences between different domains within the GitLab platform. The vulnerability affects users who have enabled the “Allow arbitrary file read” feature, which is intended to facilitate collaboration and debugging.
GitLab’s software development kit (SDK) and APIs allow developers to interact with the platform programmatically, making it possible for attackers to automate the exploitation of this flaw. This means that even if a user doesn’t click on a malicious link or download an infected file, their account can still be compromised through automated attacks. The vulnerability also allows attackers to gain access to sensitive data stored within GitLab, including code repositories and project configurations.
The severity of this issue is compounded by the fact that it has been actively exploited in the wild. This means that attackers have already begun using the flaw to compromise user accounts and steal sensitive information. Given the widespread use of GitLab among developers and organizations, the potential damage from this vulnerability could be significant.
The disclosure of the vulnerability highlights a broader issue within the cybersecurity industry: the growing trend of “in-the-wild” exploitation. This refers to attacks that are carried out by real-world attackers using publicly disclosed vulnerabilities, as opposed to purely theoretical or hypothetical examples used in lab environments. In-the-wild exploitation is often more difficult to detect and mitigate than traditional threats because it can be tailored to specific targets and exploit unique vulnerabilities.
To protect themselves from this vulnerability, GitLab users should update their platform to the latest version (15.x) as soon as possible. Users who have enabled the “Allow arbitrary file read” feature should also review their account settings to ensure that sensitive data is not accessible to unauthorized users.
Source: The Hacker News — 2026-09-11