GitLab Critical Patch Release Fixes 10.0 CVSS Remote Code Execution Flaw and 11 Other Bugs
Do Son 
TL;DR
GitLab published an urgent security update on October 21, 2026, addressing 12 newly disclosed GitLab vulnerabilities across Community Edition (CE) and Enterprise Edition (EE). The most severe flaw, CVE-2026-110264, carries a maximum 10.0 CVSS score and enables unauthenticated remote code execution. Therefore, administrators managing self-hosted instances must apply the latest patch releases immediately.
Why It Matters
GitLab is a core DevSecOps platform used by more than 30 million registered users worldwide to manage source code and CI/CD pipelines. While exact counts of exposed self-managed servers are not specified in the advisory, unauthenticated remote code execution flaws in source code repositories present an extreme risk to enterprise networks.
According to the official GitLab critical patch release advisory, GitLab.com and GitLab Dedicated tenants running versions 19.3.5-internal0 and 19.4.2-internal0 or later are already protected. Currently, no public proof-of-concept exists. In addition, no active exploitation in the wild has been confirmed for any of the 12 flaws.
How the Attack Works
The October 2026 patch bundle resolves one critical, two high, five medium, and four low-severity flaws reported via HackerOne and internal security teams.
Critical RCE and High-Severity Account Takeover
First, researcher joaxcar reported CVE-2026-110264 (CVSS 10.0), a critical integer overflow in the Regular Expression Compiler. When the server compiles a specially crafted regular expression, an unauthenticated remote attacker can trigger the overflow. As a result, the attacker can execute arbitrary code on the host.
Next, researcher stealthy discovered CVE-2026-15723 (CVSS 8.2), a high-severity authentication flaw in OmniAuth-to-LDAP auto-linking. Because the LDAP email lookup path lacks proper input sanitization when both SAML and LDAP auto-linking are active, an authenticated attacker can take over existing LDAP-backed accounts without user interaction. Meanwhile, internal team member Peter Arts identified CVE-2026-112212 (CVSS 7.5), a cache poisoning bug in OAuth/OIDC discovery endpoints. This bug lets unauthenticated attackers redirect authentication flows to external servers.
Access Control and Information Disclosure Flaws
The remaining nine GitLab vulnerabilities involve medium and low-severity access control bypasses and data leaks. Specifically, CVE-2026-12664 (CVSS 6.8) lets read_api tokens retrieve project email addresses and create work items via GraphQL. Additionally, CVE-2026-16255 (CVSS 5.9) bypasses SAML/LDAP membership locks. Also, CVE-2026-105777 (CVSS 4.3) exposes internal server credentials through improperly filtered response headers. Other patches fix milestone metadata leaks (CVE-2026-13319), AI Gateway billing checks (CVE-2026-112378), merge request cache leaks (CVE-2026-105711), approval policy bypasses (CVE-2026-14288), vulnerability record deletion (CVE-2026-112326), and Duo admin-lock controls (CVE-2026-103515).
Affected Versions
The critical flaw CVE-2026-110264 impacts GitLab CE and EE versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1. Meanwhile, the remaining 11 vulnerabilities affect various release branches starting from version 10.1. They impact up to versions prior to 19.3.6, 19.4.3, and 19.5.1.
Patch and Mitigation Steps
GitLab remediated these issues in versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13. Notably, the vendor backported the critical CVE-2026-110264 fix across older supported branches from 18.11 through 19.2. Therefore, self-managed administrators must upgrade to the corresponding patched release immediately. Also, they should monitor server logs for Onigmo native worker crashes or Org mode render error bursts.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
