Critical flaw could let anyone with no account hack companies' GitLab servers

Ten days after a first maximum-severity flaw, GitLab has to issue urgent fixes again. On October 21, the vendor of this development platform, which companies use to host source code and automate deployments, released seven patched versions. They fix a flaw tracked as CVE-2026-110264, rated 10 out of 10 on the CVSS severity scale.

According to GitLab's advisory, a user with no account could, "under certain conditions," run code of their choice on the server. Both the Community and Enterprise editions are affected, going back to version 7.0: twelve years of releases, The Hacker News noted. GitLab.com and GitLab Dedicated instances have already been patched. Only installations managed by companies themselves need to be updated.

A booby-trapped text search could be enough

The flaw lies in the component that compiles regular expressions, the text-search patterns. According to BleepingComputer, this engine parses and validates regular expressions found in configuration files. A specially crafted expression can trigger an integer overflow there. GitLab does not detail the conditions required.

The discoverer is a researcher who goes by the handle joaxcar, who reported it through GitLab's bug bounty program on the HackerOne platform. The same researcher found the flaw patched in mid-October. According to BleepingComputer, that one also affected the regular expression compiler, in the part dedicated to continuous integration.

No known attacks, but there are precedents

For now, neither GitLab nor the US cybersecurity agency (CISA) reports any exploitation. Past cases nonetheless argue against waiting. According to BleepingComputer, CISA has listed five GitLab flaws as exploited since November 2021, one of them by ransomware. A critical flaw patched last month was even added to its catalog of exploited vulnerabilities the day after the fix. The Shadowserver Foundation counts more than 2,700 GitLab Community Edition instances exposed on the internet.

The same releases fix eleven other flaws. Two are rated high severity: CVE-2026-15723 (8.2 out of 10), which could allow account takeover during automatic linking between an external login and the LDAP directory; and CVE-2026-112212 (7.5), a cache poisoning issue affecting discovery of OAuth and OpenID Connect login services.

Which version to install, and how to check

• Depending on your branch, upgrade to 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 or 18.11.13.
• The advisory lists no fix for branches older than 18.11: you need to migrate to a maintained branch.
• Versions 19.4.3 and 19.3.6 include database changes. A single-server installation will be unavailable during the update; multi-server installations can follow GitLab's zero-downtime procedure.
• GitLab publishes two detection rules to spot possible attempts, to look for in your logs: "Onigmo native worker crash" and "Org mode render error burst."

A GitLab instance holds source code, the secrets of deployment pipelines and often access to production. What remains to be seen is how long it will take before technical details or exploit code start circulating. That is often when attacks begin.