Critical and High-Severity Vulnerabilities in GitLab CE/EE

THREAT INTELLIGENCE

Peer Review

4.8

Proven Trust

Dark blue circle with two overlapping checkmarks, one green and one light blue.

ISO 27001 text with a globe outline symbol on a black background.

2025 winner badge for Cyber Security Excellence Awards with gold and black design.

Critical

CVE-2026-110264

GitLab

October 22, 2026

Executive Summary

CVE-2026-110264 (CVSS 10.0) enables unauthenticated remote code execution; twelve CVEs patched, including account takeover and cache poisoning.

Key Details

Affected Platform

GitLab CE

Attack Surface

Network accessible, unauthenticated

Recommended Action

Apply vendor patch

Affected Environment

Self-managed GitLab CE and EE from 7.0 through 18.11 and 19.0 to 19.5, before the listed fixed versions.

Operational Impact

Server takeover, account takeover, redirected authentication flows, and leakage of private project and issue data.

Technical Root Cause

Integer overflow in regular expression compilation, plus improper input sanitisation, cache trust, and access control weaknesses.

Recommended Mitigation

Upgrade to the fixed version for your branch; single-node instances should expect downtime during database migrations.

Concerned about your exposure?

Our security experts can help you assess affected systems, validate risk and support a safe remediation plan.

Discuss Your Security Exposure Explore Managed Detection and Response

Assess your risk

Identify affected systems

Plan remediation

Practical, vendor-aligned guidance

Get expert support

From our 24/7 security team

Stay ahead of emerging threats

Get the latest threat intelligence and security advisories from Smarttech247.

Full Technical Report

Download the complete analysis, including detailed technical findings and references.

Download Full Report (PDF)

References

GitLab 19.5.1 patch release notes, The Hacker News.