GitLab has released emergency security updates addressing a critical remote code execution vulnerability that could allow unauthenticated attackers to execute arbitrary code on affected servers.
Tracked as CVE-2026-110264, the flaw carries the maximum CVSS score of 10.0 and affects both Community Edition and Enterprise Edition.
The October 21, 2026, release delivers fixes across seven version branches. GitLab strongly recommends immediate upgrades for affected self-managed installations, while GitLab.com already runs a patched version.
Critical GitLab RCE Flaw
The vulnerability stems from an integer overflow triggered when GitLab compiles a specially crafted regular expression. Under certain conditions, an attacker can exploit this processing flaw to execute arbitrary code directly on the GitLab server without first authenticating.
GitLab assigns the vulnerability the CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. This assessment describes a network-accessible attack requiring low complexity, no privileges, and no user interaction.
The company credited security researcher joaxcar with reporting the issue through its HackerOne bug bounty program. Its advisory does not disclose a complete exploit chain or confirm active exploitation, although it provides dedicated detection resources for defenders.
Affected releases extend back to GitLab 7.0. The fixed versions are 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3, and 19.5.1. Administrators running earlier affected releases must upgrade to an appropriate patched version. GitLab specifically backported the critical fix to the four older branches alongside its standard patch releases.
To help self-managed customers identify exploitation attempts, GitLab published detections named “Onigmo native worker crash” and “Org mode render error burst.” These resources support investigation but do not establish that any particular crash or rendering error represents successful compromise.
The release also addresses CVE-2026-15723, an authentication flaw rated 8.2. When OmniAuth SAML and LDAP auto-linking are enabled together, an authenticated attacker could take over an existing LDAP-backed account through improperly sanitized input during identity linking.
Another high-severity issue, CVE-2026-112212, scores 7.5 and permits unauthenticated poisoning of cached OAuth/OIDC discovery documents under certain conditions.
Malicious endpoint values could redirect certain authentication flows to an attacker-controlled server. Other fixes address GraphQL token restrictions, membership controls, credential exposure, and authorization weaknesses.
GitLab Dedicated tenants running 19.3.5-internal0 and 19.4.2-internal0 or later already include the fixes and require no action. For self-managed deployments, administrators must account for database migrations when planning upgrades.
Versions 19.3.6 and 19.4.3 include regular migrations, while 19.4.3 also includes post-deployment migrations.
Single-node installations face downtime while required migrations complete; properly managed multi-node deployments can use GitLab’s zero-downtime upgrade procedures. GitLab plans to make detailed vulnerability issues public 90 days after the patch release.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
