gbhackers. Thursday, October 22, 2026 Linkedin RSS Twitter gbhackers. • Home • Threats • Cyber Attack • Data Breach • Vulnerability • What is • DFIR • Top 10 Search [](https://gbhackers.com/gitlab-patches-critical-10-0-rce-vulnerability/#) Follow us On Linkedin Discover more Cybersecurity news platform Security flaw patching Information security training CVE/vulnerabilityCyber Security NewsGitLab…
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when OmniAuth…
An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3…
published PoC ×3
Full article1,906 words · extracted from gbhackers.com · click to collapse
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when OmniAuth…
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when OmniAuth SAML and LDAP auto-linking were both enabled, an authenticated user could have taken over an existing LDAP-backed account without any interaction from the targeted user, due to improper input sanitization in the LDAP email lookup path used during OmniAuth identity linking.
An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3…
An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression.
GitLab has released emergency security updates to address a critical remote code execution vulnerabilitythat could allow unauthenticated attackers to execute arbitrary code on affected servers.
Security flaw patching
This flaw, tracked as CVE-2026-110264, carries the maximum CVSS score of 10.0 and affects both GitLab Community Edition and Enterprise Edition.
The company published the patches on October 21, 2026, urging administrators of self-managed installations to upgrade immediately.
The vulnerability stems from an integer overflow in the regular expression compiler when it processes a specially crafted regular expression. GitLab states that, under certain conditions, exploiting this vulnerability could enable arbitrary server-side code execution.
The CVSS vector for this vulnerability (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) describes a network-accessible attack that requires neither privileges nor user interaction, features low attack complexity, and has high impacts on confidentiality, integrity, and availability.
GitLab Patches Critical 10.0 RCE Flaw
The affected release range extends back to GitLab version 7.0, making the issue relevant to both longstanding deployments and recent installations.
Discover more
Android
Malware analysis service
Study Security
The fixed releases are versions 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3, and 19.5.1. GitLab has backported the RCE correction to four older release branches in addition to its standard patch releases.
The vulnerability was reported by researcher joaxcar through the company’s HackerOne bug bounty program.
Study Security
GitLab also published two threat detections for self-managed customers: “Onigmo native worker crash” and “Org mode render error burst.”
These detections are intended to support investigations into potential exploitation attempts. However, the advisory does not indicate that exploitation has occurred in the wild, and detection guidance should not be interpreted as confirmation of an active campaign.
In total, the release addresses twelve vulnerabilities, including two high-severity weaknesses. CVE-2026-15723, rated 8.2, could allow an authenticated attacker to take over an existing LDAP-backed account when both OmniAuth SAML and LDAP auto-linking are enabled.
This issue stems from improper input sanitization during the LDAP email lookup used for identity linking, without requiring interaction from the targeted account holder.
CVE-2026-112212, rated 7.5, concerns cache poisoning in OAuth/OIDC discovery endpoints. Under certain conditions, an unauthenticated attacker could manipulate a shared discovery document and redirect certain flows to an externally controlled server.
Other fixes included in this release address issues related to GraphQL token restrictions, identity-provider membership locks, internal credential exposure, private milestone metadata disclosure, AI subscription checks, confidential issue titles, approval policies, vulnerability records, and administrative AI controls.
GitLab.com is already running the patched version. GitLab Dedicated tenants using versions 19.3.5-internal0 and 19.4.2-internal0 or later already include these fixes and require no further action, according to the advisory.
Self-managed administrators should distinguish the broadly backported RCE fix from the other vulnerabilities, as the listed corrected branches begin at versions 19.3.6, 19.4.3, and 19.5.1.
Administrators must also consider database migrations during deployment. Versions 19.3.6 and 19.4.3 include regular migrations, while version 19.4.3 additionally includes post-deployment migrations.
Discover more
Ethical hacking tools
Cybersecurity news subscription
Audit Security
GitLab warns that single-node upgrades require downtime while these migrations are completed; however, properly executed zero-downtime procedures can avoid disruptions in multi-node environments. Detailed vulnerability issues are scheduled to become public ninety days after the release containing their fixes.
GBHackers on Security is a top cybersecurity news platform, delivering up-to-date coverage on breaches, emerging threats, malware, vulnerabilities, and global cyber incidents.
