GitLab flaw lets attackers run code on servers without a login

A flaw in GitLab Community and Enterprise Edition, CVE-2026-110264, could let an unauthenticated attacker run code on the server through a specially crafted regular expression, GitLab says. It rates the integer overflow 10.0 and fixed it on Oct 21 in releases for seven branches. GitLab.com already runs the fix, and GitLab hasn’t said whether anyone has exploited the flaw.

GitLab says the flaw affects every self-managed version from 7.0, under conditions it doesn’t describe. It names no deployment type, which in its advisories means every type is affected. GitLab Dedicated tenants on 19.3.5-internal0, 19.4.2-internal0 or later already have the fix. GitLab backported it to 18.11, 19.0, 19.1 and 19.2 beyond its usual patch releases, and it makes each security issue public on its tracker 90 days after the fix.

GitLab released two threat detections for self-managed instances to spot exploitation attempts, named Onigmo native worker crash and Org mode render error burst. The same releases fix 11 other flaws. The most serious, rated 8.2, lets a signed-in user take over an LDAP-backed account when OmniAuth SAML and LDAP auto-linking are both turned on.

The patch includes database migrations. GitLab says single-node instances will be down during the upgrade until the migrations finish, while multi-node instances can take the patch without downtime by following its zero-downtime upgrade procedure. A researcher reported the flaw through GitLab’s HackerOne bug bounty program, and GitLab hasn’t published technical details.