Critical GitLab Vulnerability CVE-2025-8243 (CVSS 9.9): Patch Your Instances Now

Developer Alert: GitLab Flaw Puts Projects at Risk of Takeover

If your team uses GitLab, now is not the time for a coffee break. The company has just issued an urgent security release that addresses a critical vulnerability tracked as CVE-2025-8243. The flaw received a near-maximum CVSS score of 9.9/10, so this is a serious situation.

What Is the Threat?

The vulnerability is in the CI/CD mechanism. It allows an unauthenticated attacker with access to a GitLab instance to run pipelines on behalf of another user. All it takes is a specially crafted network request.

What does this mean in practice? Imagine someone being able to trigger the build and deployment process for your application, but with their own malicious changes. The consequences could be catastrophic:

• Theft of source code and secrets (API keys, passwords).
• Injection of malicious code into your application (a supply chain attack).
• Unauthorized access to production environments.
• Complete takeover of the project.

The attack is relatively easy to carry out and requires no interaction from the victim. The issue affects all versions of GitLab Community Edition (CE) and Enterprise Edition (EE) starting with version 16.5.

What Should You Do? Update!

GitLab is urging all administrators to update their instances immediately to one of the patched versions: 18.3.2, 18.2.6, or 18.1.6. Time is critical. Once details like these are published, cybercriminals usually start scanning the internet for unpatched systems almost right away.

Even in the world of code, it seems the locks on the doors need to be changed regularly. Don't put this off!

Supply chain attacks like this are becoming more common. Read our comprehensive guide to zero-day vulnerabilities, and see our weekly roundup of critical vulnerabilities for more security alerts.

Source: GitLab Security Release