GitLab’s critical flaw is already drawing internet-wide probes

GitLab disclosed two severe vulnerabilities — including a perfect CVSS 10.0 path traversal flaw — that allow unauthenticated attackers to read arbitrary server files, potentially exposing credentials and sensitive configuration data. The fact that internet-wide probing began almost immediately after disclosure underscores how quickly threat actors monitor public CVE feeds and weaponize new vulnerabilities. For organizations running GitLab, especially self-managed Enterprise Edition instances, delays in patching can mean complete compromise of source code, secrets, and CI/CD pipelines. This incident highlights that critical infrastructure tools like source code management platforms require the same — if not greater — patching urgency as perimeter-facing systems.