GitLab CVE-2026-110264 explained in plain terms: this is a maximum-severity flaw that lets an attacker run code on a self-managed GitLab server without logging in. GitLab disclosed it on October 21, 2026, rating it a perfect 10.0 on the CVSS scale. If you run your own GitLab instance, patch now — this guide covers what the flaw is, who is affected, which versions fix it, and what to do next.
What Is GitLab CVE-2026-110264?
GitLab CVE-2026-110264 is an unauthenticated remote code execution (RCE) vulnerability in self-managed GitLab Community Edition (CE) and Enterprise Edition (EE). “Unauthenticated” means the attacker needs no account or login; “remote code execution” means they can run their own commands on your server.
The severity vector tells the story: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. That means the attack works over the network, is low complexity, requires no privileges or user interaction, and can change scope to affect the wider server, with high impact on confidentiality, integrity, and availability. That combination is why the score is 10.0, the highest possible.
The US National Vulnerability Database (NVD) published its entry on October 22, 2026, one day after GitLab’s disclosure. This is the second CVSS 10.0 regex RCE in GitLab in October 2026, after CVE-2026-97229 (patched October 12), from the same researcher, Johan “joaxcar” Carlsson, via HackerOne.
GitLab CVE-2026-110264 Explained: The Technical Root Cause
Here is what happens, step by step:
- The vulnerable component is a regex engine. GitLab relies on Onigmo, the regular expression engine used by Ruby, to process certain text patterns.
- GitLab renders Org-mode files. When GitLab displays an Org-mode (
.org) file, it uses the org-ruby gem, which builds a regular expression from the keyword on a#+TODO:line — without escaping that keyword first. - A crafted keyword overflows a counter. If that keyword is repeated more than 32,767 times, an internal counter overflows. This is the integer overflow at the heart of the flaw.
- The overflow corrupts memory and opens the door to code execution. An attacker who controls the crafted file can turn that corruption into running code on the server, as the
gituser.
The attack requirements are startlingly low. The attacker only needs one public project holding the crafted .org file for GitLab to render. No login, invitation, or victim interaction is required. Once code runs as the git user, the attacker is inside the environment where your repositories, pipelines, and credentials live.
Who Is Affected — and Who Is Not
This vulnerability affects self-managed GitLab CE and EE only, across all deployment types: Linux package, Docker, Helm chart, and source installations. Every release from version 7.0 (2014) up to the fixed versions is affected — more than a decade of releases, which is one reason exposure is so large.
You are not affected if:
- You use GitLab.com — it is already patched.
- You are a GitLab Dedicated tenant running 19.3.5-internal0, 19.4.2-internal0, or a later internal build — no action is needed.
Everyone else running a self-managed instance should assume they are affected until they confirm their version below.
On disclosure day, Censys observed roughly 82,000 hosts and about 209,000 web properties running GitLab, while Shadowserver tracked over 2,700 exposed GitLab CE instances. Censys estimated more than half of internet-exposed GitLab servers ran a release line over seven months old — the instances attackers scan for first.
Fixed Versions: The Patch Table
GitLab released fixes on October 21, 2026. There is no workaround — patching is the only fix. Find your release line below and upgrade to the fixed version (or newer) on that line.
| Release line | Fixed version |
|---|---|
| 19.5 | 19.5.1 |
| 19.4 | 19.4.3 |
| 19.3 | 19.3.6 |
| 19.2 | 19.2.9 |
| 19.1 | 19.1.9 |
| 19.0 | 19.0.10 |
| 18.11 | 18.11.13 |
Watch out for the October 12 trap. If you patched on October 12 to 19.4.2, 19.3.5, or 19.2.8 for CVE-2026-97229, you are still vulnerable here. Go one patch higher — to 19.4.3, 19.3.6, or 19.2.9. Do not assume a recent patch means you are covered.
If your instance runs an older release line with no fixed version of its own, upgrade through GitLab’s required upgrade stops to a fixed line. Skipping stops can break your instance, so follow GitLab’s official upgrade path.
How to Fix GitLab CVE-2026-110264: Update Your Instance
Follow these steps in order:
- Confirm your current version. Check Admin > Dashboard, or your package manager or Helm release, and compare it against the table above.
- Back up before you upgrade. Take a full backup of your GitLab data and configuration.
- Upgrade to a fixed version. Use your normal method — Linux package, Docker image, Helm chart, or source upgrade — and move to the fixed version for your line (or a newer fixed line via the required upgrade stops).
- Verify the new version. Re-check Admin > Dashboard and confirm the running version matches a fixed release.
- Restart and smoke-test. Confirm projects load, pipelines run, and users can sign in.
- Review public projects. Since the attack only needs one public project with a crafted
.orgfile, review which projects are public and whether that exposure is intentional.
If you manage GitLab for clients or a team, treat this as an emergency change. For help hardening a self-hosted setup, see our services page, or contact us if you need hands-on assistance with an upgrade. See also our PHP critical vulnerability guide and WordPress hacked check.
Was It Exploited? What We Know So Far
As of October 22, 2026, there was no public proof-of-concept exploit, Censys was not aware of exploitation in the wild, and the flaw had not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog at that check. That is good news — but not a reason to delay. Maximum-severity GitLab flaws attract exploit development fast, and the barrier here is low: a single crafted file in a public project. Patch first, then investigate.
How to Check for Compromise
Patching stops future attacks, but not an attack that already happened. GitLab published two detection rules to help administrators hunt for exploitation:
- “Onigmo native worker crash” — unexpected crashes in the native worker that handles regex processing.
- “Org mode render error burst” — a burst of errors when rendering Org-mode files, which could indicate crafted files being processed.
Check your logs for these signals, especially around the disclosure window and earlier: unusual .org files in public projects, unexpected processes as the git user, and unfamiliar repository or user changes.
If you find evidence of compromise, treat the instance as compromised. Rotate secrets, tokens, and keys, review repository contents and access logs, and investigate for persistence before trusting the instance again. If exploited, impact can include credential theft, repository manipulation, supply chain attacks, persistence, and lateral movement.
Why This Flaw Matters Beyond One Server
A compromised GitLab instance is not just one hacked server. GitLab holds source code, CI/CD pipelines, deployment credentials, and often the keys to production infrastructure — which is why the patch window should be measured in hours, not weeks.
For broader context, see the Censys advisory, the TechTarget report, and the Devopsity analysis.
Frequently Asked Questions
Am I affected if I use GitLab.com?
No. GitLab.com is already patched. The vulnerability affects self-managed GitLab CE and EE instances only.
Is there a workaround?
No. GitLab published no workaround. Upgrading to a fixed version is the only remediation. If you cannot patch immediately, restrict public project visibility and monitor aggressively — but treat that as a stopgap, not a fix.
Was CVE-2026-110264 exploited in the wild?
As of October 22, 2026, no public proof-of-concept existed, Censys was not aware of exploitation in the wild, and the flaw was not in the CISA KEV catalog at that check. That status can change quickly, so patch promptly regardless.
I patched on October 12 — am I safe?
Not necessarily. The October 12 patch fixed a different flaw (CVE-2026-97229). If you are on 19.4.2, 19.3.5, or 19.2.8, you are still vulnerable — upgrade one patch higher, to 19.4.3, 19.3.6, or 19.2.9.
How do I check for compromise?
Use GitLab’s two detection rules — “Onigmo native worker crash” and “Org mode render error burst” — and review logs for suspicious .org files, unexpected processes as the git user, and unfamiliar repository or user changes. If you find signs of compromise, rotate all secrets, tokens, and keys and treat the instance as compromised rather than simply patching it.
Conclusion
GitLab CVE-2026-110264 explained simply is this: a decade-spanning, login-free flaw that lets an attacker run code on self-managed GitLab servers, fixed only by upgrading. Check your version against the fixed releases — 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, or 18.11.13 — back up, patch, verify, and hunt for compromise. With no workaround, patch today, before a public exploit appears.
