srl
GitLab
GitLab is an open-source end-to-end DevOps platform with built-in version control, issue tracking, code review, CI/CD, and more. For an attacker, it is a high-value target because it holds source code, CI/CD variables, deployment keys, and cloud credentials — a single GitLab compromise frequently pivots into the entire cloud estate.
2025–2026 context: GitLab has produced a steady stream of CVSS 9.0–10.0 vulnerabilities across every layer — the GraphQL engine, the SAML implementation, the Ruby regex compiler, and the CI/CD variable system. The current attack surface is dominated by unauthenticated RCE via Onigmo (CVE-2026-110264, CVSS 10.0), SAML authentication bypass (CVE-2025-25291/25292), GraphQL-based CI/CD variable disclosure (CVE-2025-9825), and personal access token leakage through logs and public repositories (CVE-2025-13611, CVE-2025-1198).