Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases
GitLab released fixes on October 21 for a critical vulnerability that allows an attacker to execute code on a self-managed server without authentication. This flaw impacts every version of the software dating back to version 7.0, which was released in 2014.
This fix is particularly important for administrators who updated their systems nine days earlier. The October 12 update addressed only versions 19.2 and later, while the new fixed versions are one patch above that, meaning instances updated on October 12 remain vulnerable.
The vulnerability, tracked as CVE-2026-110264, has a maximum CVSS score of 10.0. GitLab indicated that under specific conditions, it could allow an unauthenticated user to execute arbitrary code on the server due to an integer overflow during the compilation of a specially crafted regular expression. However, GitLab has not disclosed what those specific conditions are.
As of October 22, GitLab reported no evidence that this flaw has been exploited in attacks. Additionally, it is not listed in the U.S. CISA catalog of known exploited vulnerabilities.
Only self-managed installations need to implement the fix, as GitLab.com is already operating on the patched version. GitLab Dedicated tenants using internal releases 19.3.5-internal0 and 19.4.2-internal0 or later have also received the fix. The company addressed the flaw across seven versions simultaneously.
The following table outlines the necessary upgrades for each release branch:
- If you run 19.5 before 19.5.1, upgrade to 19.5.1
- If you run 19.4 before 19.4.3, upgrade to 19.4.3
- If you run 19.3 before 19.3.6, upgrade to 19.3.6
- If you run 19.2 before 19.2.9, upgrade to 19.2.9
- If you run 19.1 before 19.1.9, upgrade to 19.1.9
- If you run 19.0 before 19.0.10, upgrade to 19.0.10
- If you run 7.0 through 18.11, before 18.11.13, upgrade to 18.11.13
Four of these versions are older than GitLab typically patches. The company’s policy generally covers the current release and the previous two monthly releases, which currently are 19.5, 19.4, and 19.3.
GitLab stated that it backported this fix to versions 18.11.13, 19.0.10, 19.1.9, and 19.2.9, a measure reserved for severe issues.
The reason this flaw affects such a wide range of versions is due to the regular expression compiler, which is Ruby’s built-in engine called Onigmo. GitLab includes this engine in its packages and applies its own patches. A weakness in this engine exists in every release since version 7.0.
Additionally, GitLab published two detection rules to assist self-managed administrators in identifying potential exploitation attempts. These rules, named “Onigmo native worker crash” and “Org mode render error burst,” are part of the company’s open-source TLDR framework, which formats each detection against GitLab’s application logs.
GitLab has not specified the preconditions an attacker must meet to access the compiler, meaning administrators cannot yet rule themselves out based on configuration alone. The fix remains the only guaranteed protection, and GitLab’s advisory does not provide any interim workaround.
This vulnerability marks the fourth code-execution flaw reported by the same researcher, known as joaxcar, within a month, and it is the first to affect versions prior to 19.2.
On October 12, GitLab addressed CVE-2026-97229, another unauthenticated overflow in the regex compiler, in versions 19.2.8, 19.3.5, and 19.4.2. Earlier, on September 23, the company fixed two additional vulnerabilities, CVE-2026-93577 and CVE-2026-89078, both rated 9.9 but requiring a logged-in account. The three previous vulnerabilities were limited to version 19.2, unlike this latest one.
The October 21 release resolves a total of 11 security issues, including one critical and several rated high, medium, or low.
Among the other vulnerabilities, CVE-2026-15723, rated high at 8.2, could allow a logged-in user to take over another account, but only if an administrator has enabled both SAML and LDAP auto-linking.
Another significant issue is a cache-poisoning flaw in GitLab’s OAuth and OpenID Connect endpoints, CVE-2026-112212, rated high at 7.5, which could enable an attacker to redirect certain sign-in flows to a server they control in setups utilizing a shared cache.
Administrators should plan for potential downtime during the upgrade process, as the 19.4.3 and 19.3.6 releases include database changes that require time to complete. GitLab notes that multi-node setups can apply the patch without downtime using its zero-downtime procedure.
Source: The Hacker News