GitLab vulnerability could allow unauthenticated RCE
GitLab vulnerability CVE-2026-110264 could allow unauthenticated remote code execution (RCE), meaning an attacker may be able to run commands on a self-managed server without first signing in. GitLab assigned the flaw a 10.0 score under the Common Vulnerability Scoring System (CVSS), the scale's maximum rating, and released fixes on October 21. Every GitLab release from version 7.0, which appeared in 2014, is affected unless it has been upgraded to one of the newly patched versions.
The vulnerability arises from an integer overflow, an error caused when a number exceeds the space reserved for it, while Ruby's built-in Onigmo engine compiles a specially constructed regular expression. A regular expression is a pattern that software uses to find or process matching text. GitLab includes Onigmo in its own packages and applies patches to the engine in its builds. Because the affected component has shipped with GitLab since version 7.0, the exposure extends across more release branches than the company's usual security support window.
GitLab says exploitation is possible only under certain conditions, but it has not disclosed what those conditions are. That leaves administrators unable to determine from their configuration alone whether an installation can be attacked. The advisory provides no temporary workaround, so installing a fixed release is the only certain protection identified by GitLab.
The required destination depends on the branch currently installed. Systems on 19.5 before 19.5.1 should move to 19.5.1. Version 19.4 installations before 19.4.3 require 19.4.3, while 19.3 installations before 19.3.6 require 19.3.6. Administrators running 19.2 before 19.2.9 should install 19.2.9, those on 19.1 before 19.1.9 should install 19.1.9, and those on 19.0 before 19.0.10 should install 19.0.10. All affected releases from 7.0 through 18.11 must be upgraded to 18.11.13.
Four of those fixes fall outside GitLab's normal maintenance policy. The company ordinarily patches the current monthly release and the two immediately preceding releases, which at the time were 19.5, 19.4 and 19.3. Because of the severity of CVE-2026-110264, GitLab also backported the correction to 18.11.13, 19.0.10, 19.1.9 and 19.2.9.
Administrators who installed GitLab's October 12 security updates still need to act. Those earlier patches covered only versions 19.2 and later, using releases 19.2.8, 19.3.5 and 19.4.2. The October 21 fixes are each one patch level above those versions, so a server updated on October 12 can remain vulnerable to CVE-2026-110264.
Only self-managed GitLab installations need to be upgraded by customers. GitLab.com is already operating on a fixed version. GitLab Dedicated environments using the internal releases 19.3.5-internal0 and 19.4.2-internal0, or anything later, also contain the correction.
GitLab reported no evidence that CVE-2026-110264 had been exploited in attacks. As of October 22, it was also absent from the U.S. Cybersecurity and Infrastructure Security Agency catalog of known exploited vulnerabilities. GitLab nevertheless published two rules for examining its application logs for possible attempts. Named "Onigmo native worker crash" and "Org mode render error burst," the rules are available through GitLab's open-source TLDR framework and use Sigma, a standard format for describing suspicious log activity.
This is the fourth code-execution vulnerability in GitLab's regular-expression engine reported by the same researcher within one month, and the first of those four to affect releases earlier than 19.2. On October 12, GitLab corrected CVE-2026-97229, another unauthenticated integer-overflow flaw rated 10.0, in versions 19.2.8, 19.3.5 and 19.4.2. On September 23, it fixed CVE-2026-93577 and CVE-2026-89078. Both received scores of 9.9 and required an attacker to have a logged-in account. Those three earlier vulnerabilities did not extend to versions before 19.2.
The October 21 release addresses 11 security issues in total, comprising one critical vulnerability and ten issues with high, medium or low severity. One of the additional high-severity flaws, CVE-2026-15723, has a score of 8.2 and could let an authenticated user take over another account. It applies only when an administrator has enabled automatic account linking for both Security Assertion Markup Language (SAML) and Lightweight Directory Access Protocol (LDAP), two technologies used to connect login identities.
Another high-severity issue, CVE-2026-112212, is a cache-poisoning vulnerability rated 7.5. It affects GitLab's OAuth and OpenID Connect endpoints, which participate in sign-in and account authorization. In configurations using a shared cache, an attacker could redirect certain sign-in flows to a server under the attacker's control.
Upgrade planning is particularly important for administrators of single-node systems. GitLab says versions 19.4.3 and 19.3.6 include database changes that run during installation, causing downtime on a server consisting of one node until those changes finish. Multi-node deployments can use GitLab's zero-downtime upgrade procedure. For organisations that need help managing this kind of infrastructure risk, AEU-I provides security-first IT, infrastructure and consulting.
Self-managed operators should identify their exact branch, select the corresponding fixed release and account for any required downtime. The lack of observed exploitation does not change the affected version range or remove the need to install the October 21 update.