The original text is in EN, taken from the source site. Source ↗

GitLab has released emergency security updates to address a critical remote code execution vulnerabilitythat could allow unauthenticated attackers to execute arbitrary code on affected servers.

This flaw, tracked as CVE-2026-110264, carries the maximum CVSS score of 10.0 and affects both GitLab Community Edition and Enterprise Edition.

The company published the patches on October 21, 2026, urging administrators of self-managed installations to upgrade immediately.

The vulnerability stems from an integer overflow in the regular expression compiler when it processes a specially crafted regular expression. GitLab states that, under certain conditions, exploiting this vulnerability could enable arbitrary server-side code execution.

The CVSS vector for this vulnerability (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) describes a network-accessible attack that requires neither privileges nor user interaction, features low attack complexity, and has high impacts on confidentiality, integrity, and availability.

The affected release range extends back to GitLab version 7.0, making the issue relevant to both longstanding deployments and recent installations.

The fixed releases are versions 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3, and 19.5.1. GitLab has backported the RCE correction to four older release branches in addition to its standard patch releases.

The vulnerability was reported by researcher joaxcar through the company’s HackerOne bug bounty program.

GitLab also published two threat detections for self-managed customers: “Onigmo native worker crash” and “Org mode render error burst.”

These detections are intended to support investigations into potential exploitation attempts. However, the advisory does not indicate that exploitation has occurred in the wild, and detection guidance should not be interpreted as confirmation of an active campaign.

In total, the release addresses twelve vulnerabilities, including two high-severity weaknesses. CVE-2026-15723, rated 8.2, could allow an authenticated attacker to take over an existing LDAP-backed account when both OmniAuth SAML and LDAP auto-linking are enabled.

This issue stems from improper input sanitization during the LDAP email lookup used for identity linking, without requiring interaction from the targeted account holder.

CVE-2026-112212, rated 7.5, concerns cache poisoning in OAuth/OIDC discovery endpoints. Under certain conditions, an unauthenticated attacker could manipulate a shared discovery document and redirect certain flows to an externally controlled server.

Other fixes included in this release address issues related to GraphQL token restrictions, identity-provider membership locks, internal credential exposure, private milestone metadata disclosure, AI subscription checks, confidential issue titles, approval policies, vulnerability records, and administrative AI controls.

GitLab.com is already running the patched version. GitLab Dedicated tenants using versions 19.3.5-internal0 and 19.4.2-internal0 or later already include these fixes and require no further action, according to the advisory.

Self-managed administrators should distinguish the broadly backported RCE fix from the other vulnerabilities, as the listed corrected branches begin at versions 19.3.6, 19.4.3, and 19.5.1.

Administrators must also consider database migrations during deployment. Versions 19.3.6 and 19.4.3 include regular migrations, while version 19.4.3 additionally includes post-deployment migrations.

GitLab warns that single-node upgrades require downtime while these migrations are completed; however, properly executed zero-downtime procedures can avoid disruptions in multi-node environments. Detailed vulnerability issues are scheduled to become public ninety days after the release containing their fixes.

All CVE Details

CVECVSSSeverityVulnerability / potential impact
CVE-2026-11026410.0CriticalRegular expression compiler integer overflow enabling unauthenticated RCE
CVE-2026-157238.2HighOmniAuth-to-LDAP identity-linking flaw enabling account takeover
CVE-2026-1122127.5HighOAuth/OIDC discovery cache poisoning and flow redirection
CVE-2026-126646.8MediumGraphQL scope enforcement bypass exposing incoming email addresses and enabling work-item creation
CVE-2026-162555.9MediumSAML/LDAP membership-lock bypass allowing unauthorized memberships
CVE-2026-1057774.3MediumInternal credential exposure through improperly filtered response headers
CVE-2026-133194.3MediumGroup milestones API authorization bypass exposing private project metadata
CVE-2026-1123784.3MediumAI Gateway eligibility-check bypass allowing unsubscribed feature access
CVE-2026-1057113.5LowShared rendering cache exposing confidential issue titles
CVE-2026-142883.1LowProtected-branch merge request approval policy bypass
CVE-2026-1123263.1LowError-handling flaw allowing read-only users to delete vulnerability records
CVE-2026-1035152.7LowDuo administrative-lock bypass allowing AI-backed third-party data egress

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.