GitLab patches unauthenticated CVSS 10 code-execution flaw
GitLab released patches on October 21 for CVE-2026-110264, a critical vulnerability rated 10.0 out of 10 on the CVSS scale. Under conditions GitLab has not disclosed, an unauthenticated attacker could execute arbitrary code on a self-managed GitLab server. The issue reaches back to GitLab 7.0, released in 2014.
GitLab issued fixes across seven release branches: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13. Administrators running earlier versions in each respective branch need to upgrade. GitLab.com is already on a fixed version, while GitLab Dedicated tenants on 19.3.5-internal0 or 19.4.2-internal0 and later are already protected.
An overflow in GitLab’s bundled regex engine
The flaw is an integer overflow in Onigmo, Ruby’s built-in regular-expression engine, during compilation of a specially crafted regular expression. GitLab packages and patches Onigmo in its own builds, which explains why the defect is present throughout the long range of affected GitLab releases.
GitLab has not specified the conditions required to reach the vulnerable compiler. As a result, an administrator cannot exclude exposure based on configuration alone. The advisory provides no interim mitigation, making installation of a fixed release the only stated protection.
The company reported no evidence that CVE-2026-110264 has been exploited. As of October 22, the vulnerability was also absent from the U.S. CISA Known Exploited Vulnerabilities catalog. Those facts do not change the severity of an unauthenticated server-side code-execution issue affecting installations that organizations operate themselves.
Broad backports and deployment planning
Four of the patched versions fall outside GitLab’s ordinary support policy. The company normally maintains the current release and two previous monthly releases, which were 19.5, 19.4 and 19.3 at publication. It nevertheless backported the fix to 18.11.13, 19.0.10, 19.1.9 and 19.2.9 because of the issue’s severity.
The release addresses 11 security issues in total. It also fixes CVE-2026-15723, rated 8.2, which could let an authenticated user take over another account when both SAML and LDAP auto-linking are enabled. CVE-2026-112212, rated 7.5, concerns cache poisoning in OAuth and OpenID Connect endpoints and could redirect certain sign-in flows to an attacker-controlled server where a shared cache is used.
GitLab published two open-source TLDR detection rules in Sigma format for its application logs: Onigmo native worker crash and Org mode render error burst. They can help self-managed teams search for exploitation attempts, although they do not replace patching.
What administrators should do
Teams that patched the related October 12 issue should check their installed version again. That earlier update covered version 19.2 and newer; the October 21 fixes are one patch level later in the affected branches. GitLab also notes that upgrades to 19.4.3 and 19.3.6 include database changes, causing downtime on a single-node server while they complete. Multi-node deployments can use GitLab’s zero-downtime procedure.
The immediate business implication is to inventory all self-managed GitLab instances, upgrade each to the matching fixed release, plan maintenance for single-node database changes, and review application logs with the supplied detection rules.