GitLab has issued urgent security updates to fix a critical vulnerability that could allow attackers to run code on self-managed servers without authentication. Identified as CVE-2026-110264, the flaw has a CVSS score of 10.0 and affects both GitLab Community Edition and Enterprise Edition. The company released the patches on October 21, 2026.
The vulnerable code dates back to GitLab 7.0, released in 2014, giving the issue an approximate 12-year history. That historical reach does not mean the vulnerability has been actively exploited for that entire period. GitLab’s advisory explains the risk but does not report confirmed attacks or publish a public exploit.
GitLab remote code execution flaw
According to GitLab’s security advisory, the defect is an integer overflow triggered when the server compiles a specially crafted regular expression. Regular expressions are patterns used to match text; under certain conditions, processing an attacker-controlled pattern can enable arbitrary code execution on the server.
GitLab’s CVSS evaluation describes a network attack with low complexity that requires no account privileges and no user interaction. The potential impact on data confidentiality, integrity, and availability is rated high. GitLab has not disclosed complete details about the specific conditions required to reach the vulnerable code path.
GitLab credited security researcher joaxcar for reporting the issue through its HackerOne bug bounty program. The release notes also reference Ruby regular-expression patches, giving additional context about the affected software layer while avoiding a full disclosure of the attack path. Administrators should not assume the exploit requires access to a particular project or feature unless GitLab explicitly states that limitation.
| CVE ID | Severity | CVSS Score | Affected Edition | Vulnerability and Potential Impact |
|---|---|---|---|---|
| CVE-2026-110264 | Critical | 10.0 | CE and EE | An integer overflow while compiling a specially crafted regular expression could allow an unauthenticated attacker to execute code on the GitLab server. |
| CVE-2026-15723 | High | 8.2 | CE and EE | Insufficient input handling during OmniAuth-to-LDAP account linking could let an authenticated attacker take over an LDAP-backed account when SAML and LDAP auto-linking are both enabled. |
| CVE-2026-112212 | High | 7.5 | CE and EE | Cache poisoning in OAuth/OpenID Connect discovery responses could allow an unauthenticated attacker to redirect certain authentication flows to an attacker-controlled server. |
| CVE-2026-12664 | Medium | 6.8 | CE and EE | Missing GraphQL scope checks could permit a user with a read_api token to retrieve a project’s incoming email address and create work items beyond the token’s intended permissions. |
| CVE-2026-16255 | Medium | 5.9 | EE | Incomplete enforcement of SAML/LDAP membership locks could allow authenticated users to grant or accept memberships outside identity-provider controls via requests created before the lock was enabled. |
| CVE-2026-105777 | Medium | 4.3 | CE and EE | Improper filtering of internal response headers could expose sensitive internal server credentials under certain conditions. |
| CVE-2026-13319 | Medium | 4.3 | CE and EE | Missing authorization checks in the group milestones API could let authenticated users read milestone details and project paths from private projects without membership. |
| CVE-2026-112378 | Medium | 4.3 | EE | Insufficient server-side billing checks could allow authenticated users to access paid AI features without a valid subscription. |
| CVE-2026-105711 | Low | 3.5 | CE and EE | Incorrect caching of merge request titles could expose confidential issue titles to authenticated users who are not project members. |
| CVE-2026-14288 | Low | 3.1 | EE | Improper access control during approval-rule synchronization could allow authenticated users to bypass required merge request approvals on protected branches. |
| CVE-2026-112326 | Low | 3.1 | EE | Incorrect cleanup during error handling could allow users with read-only permissions to permanently delete existing vulnerability records. |
| CVE-2026-103515 | Low | 2.7 | EE | Incomplete enforcement of a Duo administrator lock could allow group Owners to re-enable AI-backed data transfers to a third-party service through Amazon Q settings. |
Affected versions and available fixes
The flaw affects GitLab CE and EE starting with version 7.0. GitLab has issued fixes in the following releases: 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3, and 19.5.1. Earlier builds in those branches remain vulnerable. GitLab extended the fix to four older branches in addition to its usual patch releases.
Self-managed customers should upgrade immediately. GitLab.com is already running patched software. GitLab Dedicated tenants on 19.3.5-internal0, 19.4.2-internal0, or later already have the fixes and do not need to take action, according to the advisory. GitLab also notes that if an advisory does not specify a deployment type, all deployment types should be considered affected.
This issue is distinct from a separate GitLab code-execution flaw patched on October 12 (CVE-2026-97229). That earlier vulnerability also involved regular-expression handling but affected different versions; installing the October 12 update does not mitigate this newly disclosed issue.
GitLab published two detection guides for self-managed environments, titled “Onigmo native worker crash” and “Org mode render error burst,” to help security teams identify potential exploitation attempts. The existence of those guides is not evidence that attacks have occurred, and the release does not present either guide as proof of a successful compromise.
The patch release addresses a total of 12 vulnerabilities. Another notable issue, CVE-2026-15723, has a CVSS score of 8.2 and can allow account takeover of an LDAP-backed account when OmniAuth SAML and LDAP auto-linking are both enabled. CVE-2026-112212, rated 7.5, concerns poisoned OAuth and OpenID Connect discovery responses that could redirect authentication flows to an attacker-controlled server.
These updates follow other recent GitLab security fixes, including a separate remote command execution flaw in the AI Gateway. Those reports affect different components and have different exploitation requirements, so administrators should verify exact versions rather than assume a single update covers all related issues.
Administrators should consult GitLab’s upgrade instructions before applying updates. The advisory warns that database migrations can affect the upgrade process: single-node installations may require downtime, while zero-downtime procedures are available for appropriate multi-node configurations.
Versions 19.3.6 and 19.4.3 include regular database migrations. GitLab typically publishes full technical details 90 days after patching, so teams are advised not to delay updates while waiting for the complete analysis.
The GitLab patches arrive alongside security updates for Node.js and PHP, increasing the patching workload for teams that run web applications and development services.
According to Cyber Security News, Node.js released fixes for ten vulnerabilities across its 26.x, 24.x, and 22.x branches, with patched releases 26.12.1, 24.22.1, and 22.23.4.
PHP issued emergency patches for a pair of critical memory-handling flaws known as PHP2Shell, tracked as CVE-2026-109618 and CVE-2026-109619.
Update defenses against new malware as soon as it appears. Integrate threat intelligence feeds with data from 16K SOCs.
