title: Shell or Network Tool Spawned by GitLab Puma, Sidekiq or Workhorse
id: 8c1d4e7a-2f35-4b6e-9d08-5a9e1c3b7f42
status: experimental
description: |
    A GitLab application process (Puma, Sidekiq, gitlab-workhorse) starts a shell, scripting interpreter or network
    tool. GitLab's TLDR response guidance for CVE-2026-110264 says to hunt for unexpected child processes of Puma;
    the RCE runs as the git user. Baseline first: hooks and some features legitimately use sh.
references:
    - https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/
    - https://gitlab.com/gitlab-security-oss/tldr/-/blob/main/Detections/platforms/GitLab/Vulnerability%20Detections/org_mode_render_error_burst.md
author: Cybaverse
date: 2026-10-21
tags:
    - attack.execution
    - attack.t1059.004
    - attack.t1190
    - cve.2026-110264
logsource:
    product: linux
    category: process_creation
detection:
    selection_parent:
        - ParentCommandLine|contains:
            - 'puma: cluster worker'
            - 'puma '
            - 'sidekiq '
        - ParentImage|endswith:
            - '/gitlab-workhorse'
            - '/puma'
            - '/sidekiq'
    selection_child:
        Image|endswith:
            - '/sh'
            - '/bash'
            - '/dash'
            - '/python'
            - '/python3'
            - '/perl'
            - '/nc'
            - '/ncat'
            - '/socat'
            - '/curl'
            - '/wget'
            - '/busybox'
            - '/base64'
            - '/crontab'
            - '/whoami'
            - '/id'
    condition: selection_parent and selection_child
falsepositives:
    - Custom server hooks, import/export and backup jobs, admin rake tasks
level: high