GitLab fixes a maximum-severity flaw that let attackers run code without logging in

This is a summary of a security advisory first published by GitLab and reported by other outlets. Zron Tech did not discover or test the vulnerability.

What happened

On October 22, 2026, GitLab released patch versions for a critical security flaw tracked as CVE-2026-110264. Singapore’s Cyber Security Agency rated it 10 out of 10 on the CVSS v3.1 scale, the highest possible score.

The bug sits in the part of GitLab that reads and checks regular expressions (search patterns) in configuration files. According to BleepingComputer, it is an integer overflow. Under certain conditions, an attacker who is not logged in could send a specially crafted pattern and run their own code on the GitLab server.

Who is affected

• Self-managed GitLab Community Edition (CE) and Enterprise Edition (EE). The advisory lists every version from 7.0 up to the fixed releases below. That covers more than a decade of releases.
• GitLab.com is not affected. GitLab had already moved its cloud service to the fixed code.
• GitLab Dedicated customers on the patched internal versions already have the fix.

If you only use GitLab through a browser at gitlab.com, you do not need to do anything.

Which versions fix it

Your version line	Update to at least
19.5	19.5.1
19.4	19.4.3
19.3	19.3.6
19.2	19.2.9
19.1	19.1.9
19.0	19.0.10
18.11 and older	18.11.13, or move to a current 19.x release

Has it been exploited?

At the time BleepingComputer published its report, there were no reports of attackers using this specific flaw. That can change quickly once a patch is public, because attackers study patches to learn how to attack servers that have not updated.

What to do now

1. Check your version. In GitLab, open the Help page or the Admin Area overview to see the exact version number.
2. Back up first. Take a fresh backup before you upgrade, as GitLab recommends for any upgrade.
3. Update to a fixed version from the table above.
4. Limit exposure. If your GitLab server does not need to be public, put it behind a VPN or restrict it to trusted networks.
5. Review logs for unusual activity since mid-October, especially if your server was reachable from the internet.

Why it matters

Code hosting servers often hold source code, passwords for deployment, and access tokens for cloud accounts. A bug that lets an outsider run code without a password is one of the most serious kinds of security flaw, which is why this one received the maximum score.

We will update this article if GitLab or security agencies report active exploitation.