Self-hosted GitLab servers can be made to run an outsider’s code. Upgrade to 19.5.1, 19.4.3 or 19.3.6 today

If your company hosts its own GitLab, the server that holds your source code and CI secrets has a new patch to install. GitLab shipped a critical release on Wednesday for CVE-2026-110264, rated 10.0, which can let someone with no account run code on the server.

GitLab.com is already patched. Self-managed installs are not, and every version from 7.0 onward is affected. GitLab has not reported attacks, but the same researcher found a similar 10.0 bug ten days ago, and the fix itself now shows people where to look.

Every self-managed GitLab since version 7.0 can be made to run an outsider’s code. GitLab.com is patched. Your server is your job.

The 5-Minute Cyber Brief

Don’t Miss the Policy Changes That Affect Security Decisions

Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.

Email addressSend me tomorrow’s brief

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

GitLab fixes a 10.0 flaw that runs code without a login

GitLab released 19.5.1, 19.4.3 and 19.3.6 for Community and Enterprise Editions on October 21, and backported the fix to 19.2.9, 19.1.9, 19.0.10 and 18.11.13. It calls the bug an integer overflow in its regular expression compiler, reported by the researcher joaxcar through HackerOne.

GitLab’s published detection notes place the flaw in the renderer for Org-mode (.org) files, which builds a regular expression from a keyword line inside the file. CVSS 3.1 scores it 10.0 with no login and no user interaction needed.

The same release fixes two high-severity bugs: an LDAP account takeover when OmniAuth SAML and LDAP auto-linking are both on (CVE-2026-15723, 8.2) and a cache-poisoning flaw in the OAuth/OIDC discovery endpoints (CVE-2026-112212, 7.5).

Every self-managed GitLab server back to version 7.0

A GitLab server holds source code, CI/CD variables, deploy keys and runner tokens, so code execution there reaches far past the repository. This is the second 10.0 code-execution bug in GitLab’s regex handling this month; we covered the first on October 13.

Shadowserver tracks more than 2,700 GitLab Community Edition servers reachable from the internet, BleepingComputer reported. GitLab Dedicated tenants on 19.3.5-internal0 or 19.4.2-internal0 or later already have the fix.

Move to 19.5.1, 19.4.3 or 19.3.6, or the backport for your branch

• Find every self-managed GitLab instance, including test and forgotten ones, and note its version on the Admin area overview page.
• Upgrade to 19.5.1, 19.4.3 or 19.3.6. On older branches, install 19.2.9, 19.1.9, 19.0.10 or 18.11.13.
• Plan downtime on single-node servers: GitLab says 19.4.3 and 19.3.6 include database migrations that must finish before GitLab starts. Multi-node installs can use zero-downtime upgrades.
• If the upgrade has to wait, keep the instance off the open internet and turn off public sign-up and public projects.

Details

• CVE-2026-110264: integer overflow in the regular expression compiler, GitLab CE/EE, CVSS 3.1 10.0 (AV:N/AC:L/PR:N/UI:N/S:C). Affects 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, 19.5 before 19.5.1.
• CVE-2026-15723 (8.2): OmniAuth-to-LDAP auto-linking account takeover. CVE-2026-112212 (7.5): OAuth/OIDC discovery cache poisoning. Fixed in 19.5.1, 19.4.3 and 19.3.6.
• Exploitation: none reported by GitLab. GitLab.com runs the fix; Dedicated is fixed on 19.3.5-internal0 / 19.4.2-internal0 and later.
• Agencies: CERT-EU advises patching internet-facing servers first and running a compromise assessment.

Hunt / verify

• Use GitLab’s Org-mode render error burst rule: five or more Timeout::Error exceptions from the OtherMarkup renderer on .org files from one client within 30 minutes, in exceptions_json.log.
• Check puma_stderr.log for native Ruby [BUG] crashes that mention org-ruby or Onigmo frames (rule). GitLab notes a successful exploit may not crash anything, so a clean log does not clear a server.
• Search repositories for .org files with an unusually long #+TODO: line.

Source: GitLab critical patch release, October 21, 2026; CVE.org: CVE-2026-110264

Sources

• GitLab: Critical Patch Release 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13
• GitLab Security: Org mode render error burst detection
• GitLab Security: Onigmo native worker crash detection
• CERT-EU: Critical Vulnerability in GitLab Community and Enterprise Editions
• BleepingComputer: GitLab warns of new max severity code execution vulnerability
• CVE.org: CVE-2026-110264

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].