Summary
- CVE-2026-110264 carries a CVSS 10.0 score and can enable server code execution under certain conditions.
- GitLab issued fixes across seven maintained and backported release lines.
- GitLab.com is patched; administrators of affected self-managed installations must check their versions.
GitLab has issued an unusually broad critical patch release to fix a vulnerability that could allow unauthenticated code execution on affected self-managed servers. CVE-2026-110264 is scored 10.0 under CVSS 3.1 and concerns an integer overflow in regular expression compilation under particular conditions.
On 21 October the company released versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13 for Community Edition and Enterprise Edition. The additional backports extend the available fixes beyond its normal maintenance window. GitLab says its hosted GitLab.com service is patched and that specified GitLab Dedicated versions already include the corrections.
The critical issue may allow an unauthenticated user to execute arbitrary code on a GitLab server by causing an integer overflow in a specially crafted regular expression. GitLab does not state that every installation is exploitable in every configuration. Its advisory identifies affected release ranges extending back to version 7.0, with the relevant fixed versions varying by release line.
GitLab credited an external researcher reporting through its HackerOne programme and published threat detection guidance for two event types associated with attempted exploitation. The indicators refer to an Onigmo native worker crash and bursts of Org mode rendering errors. Their publication supports investigation but is not a declaration that successful exploitation has been observed at a particular organisation.
Source code platforms carry broader organisational privileges
Self-managed GitLab systems often sit close to source code repositories, merge request approvals, pipeline configuration and the credentials needed to build or deploy software. Code execution on the hosting server can therefore extend beyond the confidentiality of individual project files. The precise impact depends on server configuration, permissions, token management and connections to other systems, rather than the CVSS score alone.
The patch release addresses other weaknesses at the same time. GitLab describes a high-severity identity linking problem in configurations using both OmniAuth SAML and LDAP auto-linking, which could permit account takeover without interaction from the targeted user. Another high-severity issue concerns poisoning of cached OAuth or OpenID Connect discovery data, potentially redirecting certain authentication flows. These are separate flaws from the regular expression issue and have different conditions.
Additional fixes cover access controls on GraphQL work items, enforcement of directory membership restrictions, internal response header filtering and other functions. Administrators cannot infer that upgrading only an authentication component mitigates the code execution issue, because the vulnerabilities sit in different parts of the application. The company’s version-specific release notes remain the authoritative source for affected builds.
The company has also clarified the difference between its hosted and customer-managed environments. Patches deployed to GitLab.com do not automatically repair an independently operated instance, which may have distinct update policies or dependencies. Operators running older software must determine a supported upgrade or backport path rather than assuming that a general announcement equates to remediation.
Among the other corrections, GitLab describes a defect in the enforcement of instance-wide SAML or LDAP membership locks, allowing some previously initiated requests to add members outside an identity provider’s intended controls. Another issue could expose confidential issue titles in a merge request under particular caching circumstances. These problems differ in severity and exploitation prerequisites, but they demonstrate why the release is broader than a single critical CVE. GitLab identifies both CE and EE where relevant and lists enterprise-only issues separately, requiring administrators to match fixes to deployed features.
GitLab recommends upgrading affected installations immediately and says its fixes have been applied to the managed services described in its advisory. GitLab’s advisory identifies conditional exploitation paths and detection guidance but reports no independently confirmed victim count for CVE-2026-110264.
