GitLab CVE-2026-110264: CVSS 10 unauthenticated RCE, fixed on October 21

What happened

GitLab released a critical patch on October 21, 2026, yesterday. It fixes CVE-2026-110264, rated CVSS 10.0, the maximum.

GitLab says that, under certain conditions, an unauthenticated attacker could run code on the GitLab server. The cause is an integer overflow when GitLab compiles a specially crafted regular expression.

GitLab's advisory gives a date, not a time. Its docs navigation entry for the release was merged around 19:00 UTC on October 21. The CVE record went public at 00:33 UTC on October 22.

The flaw reaches back to GitLab 7.0, released in 2014. That is about twelve years of releases.

Who is affected

Only self-managed GitLab CE and EE installations need to act. Every install type is in scope: Omnibus, source, Docker and Helm.

• GitLab.com already runs the fix.
• GitLab Dedicated tenants on 19.3.5-internal0, 19.4.2-internal0 or later need no action.

Affected versions, per GitLab:

• 7.0 up to, but not including, 18.11.13
• 19.0 before 19.0.10
• 19.1 before 19.1.9
• 19.2 before 19.2.9
• 19.3 before 19.3.6
• 19.4 before 19.4.3
• 19.5 before 19.5.1

GitLab normally patches only the three newest lines. This time it also backported the fix to 19.2, 19.1, 19.0 and 18.11. Lines older than 18.11 get no fix. They must upgrade to a supported line.

Patched on October 12? You are still exposed. That release fixed the separate CVE-2026-97229 CI regex flaw. Its versions, 19.4.2, 19.3.5 and 19.2.8, are below the new fixed versions.

What is confirmed

The advisory says little about the bug. GitLab's own detection rules, published the same day, say more.

They say GitLab renders Org-mode (.org) files with the org-ruby gem. That gem puts a raw keyword from a #+TODO: line into a regular expression. A crafted keyword overflows a counter in Onigmo, Ruby's regex engine. The result is an out-of-bounds memory write.

GitLab's rules say this can become code execution as the git user. They say the attacker needs no account, only one public project holding a crafted .org file.

On a successful attack, GitLab lists theft of instance secrets, all CI/CD variables, runner tokens and access tokens. The attacker would also reach every repository.

The CVE record maps the flaw to CWE-190, integer overflow. GitLab's detection rules describe the Org-mode path as CWE-94 and CWE-787.

The same release fixes 11 other issues. They include a high-severity LDAP account takeover, CVE-2026-15723, and an OAuth/OIDC cache poisoning bug, CVE-2026-112212.

The flaw was reported by joaxcar through GitLab's HackerOne bug bounty program. The same researcher reported the October 12 regex flaw.

What is not confirmed

Exploitation. No attacks have been reported. The CVE is not in the CISA KEV catalog (catalog 2026.10.21). We found no CISA alert.

Public PoC. We found no confirmed public PoC. A GitHub repository created on October 22 claims to cover this CVE. Its own README says the code targets the earlier CVE-2026-97229 bug and is unverified for this one. ThreatWire did not run it and does not link it.

Full details. GitLab's issue and the HackerOne report are not public. GitLab publishes issue details 90 days after a fix, so expect them around January 2027.

Scoring. NVD has not analyzed the record yet. The 10.0 score comes from GitLab. GitHub's advisory is unreviewed.

What to do now

1. Check your version. Go to Admin area, then Overview, or open /help on your instance.
2. Upgrade now to the fixed version for your line: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 or 18.11.13.
3. On 18.10 or older? There is no patch. Plan an upgrade path to a supported line with GitLab's upgrade path tool.
4. Plan for downtime. 19.4.3 and 19.3.6 include database migrations. Multi-node setups can follow GitLab's zero-downtime upgrade steps.
5. Until you patch, limit public projects and public sign-up where you can. GitLab's rules say the unauthenticated path needs a public .org file. This narrows exposure. It does not fix the bug.
6. Hunt for attempts. Deploy GitLab's two detection rules: "Org mode render error burst" and "Onigmo native worker crash". Look for bursts of .org render timeouts in exceptions_json.log. Look for Onigmo crashes in puma_stderr.log.
7. Do not trust a clean log. GitLab warns a successful exploit can be quiet. If your instance was public and unpatched, review new .org files, then rotate runner tokens, access tokens and CI/CD secrets if anything looks off.

Related coverage

Full record: CVE-2026-110264 on ThreatWire.

Earlier this month: GitLab CI regex compiler RCE, CVE-2026-97229. Also patched this week: PHP's critical security release. Browse the CVE tracker and actively exploited CVEs.

Sources: GitLab's critical patch release and TLDR detection rules, CVE.org, NVD, the GitHub Advisory Database, the CISA KEV catalog, The Hacker News, Konfirmity and al-ice.ai. Links are in the references list.