MDR
Solutions
Partners
About
Resources
Affected Environment
Self-managed GitLab CE and EE from 7.0 through 18.11 and 19.0 to 19.5, before the listed fixed versions.
Threat Overview
CVE-2026-110264 (CVSS 10.0) enables unauthenticated remote code execution; twelve CVEs patched, including account takeover and cache poisoning.
Exposure Timeline
Patch release 22 October 2026; fixes in 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13.
Attack Surface
Internet-reachable GitLab servers, regular expression compiler, OmniAuth and LDAP linking, OAuth and OIDC discovery endpoints, and GraphQL.
Technical Root Cause
Integer overflow in regular expression compilation, plus improper input sanitisation, cache trust, and access control weaknesses.
Exploitation Pathway
Unauthenticated attacker submits a crafted regular expression to execute code; authenticated attackers abuse SAML and LDAP auto-linking for account takeover.
Operational Impact
Server takeover, account takeover, redirected authentication flows, and leakage of private project and issue data.
Strategic Impact
Source control compromise threatens software supply chain integrity; all entity sizes rated Critical.
Required Mitigation
Upgrade to the fixed version for your branch; single-node instances should expect downtime during database migrations.
Incident Response Guidance
Enable GitLab's two exploitation detections (Onigmo worker crash, Org mode render error burst) and review authentication and membership changes.
References
GitLab 19.5.1 patch release notes, The Hacker News.
Trusted by clients worldwide
Led by human expertise and powered by the VisionX platform, we provide you with a 24/7 unbeatable Managed Detection & Response capability giving you transparent and consolidated security solutions.
.jpg)