Story · 5 sources · 5 articlesfirst Oct 21, 18:57 UTCupdated Oct 22, 11:41 UTC (5h ago)

GitLab warns of new max severity code execution vulnerability

criticalVulnerabilityexploited in the wildimportance 90CVE-2026-110264 CVE-2026-97229 CVE-2026-85706 CVE-2026-93577 CVE-2026-89078 CVE-2026-15723 CVE-2026-112212 CVE-2026-109618

Merged summary · from the lead article

GitLab has released security patches for a maximum-severity Regular Expression Compiler flaw that can let remote attackers run arbitrary code on vulnerable servers. This security issue is tracked as CVE-2026-110264 and was reported by a security researcher using the ' joaxcar ' handle through GitLab's HackerOne bug bounty program. CVE-2026-110264 stems from an integer overflow weakness in…

Coverage timelineoldest first · each row is one article

Oct 21, 18:57 UTC · 22h ago
The Hacker News· 90
Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases
Oct 21, 19:01 UTC · 22h ago
Hacker News · security· 50
GitLab CVSS 10.0 Integer Overflow issue
00:00 UTC · 17h ago
CERT-EU Advisories· 83
2026-019: Critical Vulnerability in GitLab Community and Enterprise Editions
02:06 UTC

Vulnerabilities in this storyAll →

CVE-2026-1096199.26%
PHP has various global state that temporarily points into request memory
published 1d ago· php php PoC ×7+1 related
CVE-2026-110264

CVE	Vulnerability	CVSS	EPSS	Flags	Affected	Exposure	Published
CVE-2026-109619 +1 related CVE CVE-2026-109618	PHP has various global state that temporarily points into request memory PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE). NVD description · AI analysis pending	9.2	6%	PoC ×7	php php	—	1d ago
CVE-2026-110264	An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3… An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression. NVD description · AI analysis pending	10.0	—	PoC ×3	—	—	16h ago
CVE-2026-15723 +1 related CVE CVE-2026-112212	GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when OmniAuth… GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when OmniAuth SAML and LDAP auto-linking were both enabled, an authenticated user could have taken over an existing LDAP-backed account without any interaction from the targeted user, due to improper input sanitization in the LDAP email lookup path used during OmniAuth identity linking. NVD description · AI analysis pending	8.2 group max	—		—	—	16h ago
CVE-2026-85706	Unauthenticated Path Traversal Arbitrary File Read in GitLab CE/EE CVE-2026-85706 is a path traversal flaw (CWE-35) in GitLab Community Edition and Enterprise Edition in which the repository commits API does not properly confine file paths and does not enforce authentication, allowing an unauthenticated attacker to read arbitrary files from the GitLab server. It is triggered by sending a crafted unauthenticated request to the commits API that supplies traversal sequences moving outside the intended repository path. An attacker gains the ability to read arbitrary files on the host, which can expose configuration files, certificates, and stored credentials or keys; related reporting on the recent GitLab patch wave also notes credential theft and code execution flaws, though this CVE itself is the file-read issue. All self-managed GitLab CE and EE deployments are in scope, and CISA did not publish specific affected version ranges in this data. The flaw was added to CISA's KEV catalog on 2026-09-11 and is being actively probed and exploited in the wild within a day of disclosure, with three public proof-of-concept repositories available; ransomware use is not yet confirmed. Do: Upgrade GitLab CE/EE to the patched release identified in GitLab's security advisory (no specific fixed version number is provided in this data), prioritizing internet-facing instances in line with CISA BOD 26-04; if patching is not immediately possible, restrict exposure and review access logs for unauthenticated requests to the commits API containing path traversal sequences. Because arbitrary file read can expose server-side secrets, inventory and rotate credentials, tokens, and keys stored on or reachable by affected GitLab hosts.	10.0	92%	KEV PoC ×13
CVE-2026-89078 +1 related CVE CVE-2026-93577	Authenticated RCE in GitLab CE/EE via Double Free in CI/CD Regex Parsing GitLab CE/EE contains a double free (CWE-415) memory corruption flaw in the code that parses regular expressions in CI/CD pipeline configurations. An authenticated attacker — for example a user who can create a project or edit a .gitlab-ci.yml file containing a specially crafted regular expression — can trigger the bug during config parsing and execute arbitrary code on the GitLab server itself. The CVSS 3.1 base score is 9.9 (critical), reflecting low-privilege authentication requirements but full compromise of server confidentiality and integrity with scope change, since code runs outside the application's normal context. All self-managed installations from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 are affected; GitLab.com (the vendor's SaaS offering) is centrally managed and not exposed to unpatched customer instances. There is no known public proof-of-concept, the issue is not on the CISA KEV list, and no exploitation has been reported, though GitLab instances are high-value targets for source-code and secrets theft. Do: Upgrade self-managed instances immediately to 19.2.7, 19.3.3, or 19.4.1 (or later) matching your minor release track. Until patched, restrict who can create projects or edit CI/CD configuration files, and review recent .gitlab-ci.yml commits for unusual or overly complex regular expressions. Audit GitLab server logs and CI/CD job history for anomalous pipelines or unexpected process activity originating from the GitLab application host.	9.9	—		GitLab Community Edition (CE) >= 19.2 and < 19.2.7; >= 19.3 and < 19.3.3; >= 19.4 and < 19.4.1 GitLab Enterprise Edition (EE) >= 19.2 and < 19.2.7; >= 19.3 and < 19.3.3; >= 19.4 and < 19.4.1
CVE-2026-97229	Unauthenticated RCE in GitLab CE/EE via CI/CD regex GitLab remediated a critical flaw in GitLab Community Edition and Enterprise Edition in which insufficient validation of a regular expression in CI/CD configuration can let an unauthenticated remote attacker run arbitrary code on the GitLab server under certain conditions. The issue is triggered by a specially crafted regular expression supplied through CI/CD configuration and does not require a logged-in user. Successful exploitation yields full confidentiality, integrity, and availability impact on the server, with a changed scope (CVSS 3.1 10.0). It affects all 19.2 releases before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. It is not listed in CISA KEV and no public proof-of-concept is known. Do: Upgrade self-managed GitLab CE/EE to 19.2.8, 19.3.5, or 19.4.2 (or any later release on a supported line). Until patched, keep the instance off the public internet, restrict who can reach the web UI and API, and review recent CI/CD configuration changes for unexpected regular expressions.	10.0	<1%	PoC ×4	GitLab CE/EE 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2	large

CVE

Vulnerability

CVSS

EPSS

Flags

Affected

Exposure

Published

CVE-2026-109619

+1 related CVE

CVE-2026-109618

PHP has various global state that temporarily points into request memory

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).

NVD description · AI analysis pending

9.2

PoC ×7

php php

—

1d ago

CVE-2026-110264

An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3…

An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression.

NVD description · AI analysis pending

10.0

—

PoC ×3

—

16h ago

CVE-2026-15723

+1 related CVE

CVE-2026-112212

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when OmniAuth…

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when OmniAuth SAML and LDAP auto-linking were both enabled, an authenticated user could have taken over an existing LDAP-backed account without any interaction from the targeted user, due to improper input sanitization in the LDAP email lookup path used during OmniAuth identity linking.

NVD description · AI analysis pending

8.2

group max

—

16h ago

CVE-2026-85706

Unauthenticated Path Traversal Arbitrary File Read in GitLab CE/EE

CVE-2026-85706 is a path traversal flaw (CWE-35) in GitLab Community Edition and Enterprise Edition in which the repository commits API does not properly confine file paths and does not enforce authentication, allowing an unauthenticated attacker to read arbitrary files from the GitLab server. It is triggered by sending a crafted unauthenticated request to the commits API that supplies traversal sequences moving outside the intended repository path. An attacker gains the ability to read arbitrary files on the host, which can expose configuration files, certificates, and stored credentials or keys; related reporting on the recent GitLab patch wave also notes credential theft and code execution flaws, though this CVE itself is the file-read issue. All self-managed GitLab CE and EE deployments are in scope, and CISA did not publish specific affected version ranges in this data. The flaw was added to CISA's KEV catalog on 2026-09-11 and is being actively probed and exploited in the wild within a day of disclosure, with three public proof-of-concept repositories available; ransomware use is not yet confirmed.

Do: Upgrade GitLab CE/EE to the patched release identified in GitLab's security advisory (no specific fixed version number is provided in this data), prioritizing internet-facing instances in line with CISA BOD 26-04; if patching is not immediately possible, restrict exposure and review access logs for unauthenticated requests to the commits API containing path traversal sequences. Because arbitrary file read can expose server-side secrets, inventory and rotate credentials, tokens, and keys stored on or reachable by affected GitLab hosts.

10.0

92%

KEV PoC ×13

CVE-2026-89078

+1 related CVE

CVE-2026-93577

Authenticated RCE in GitLab CE/EE via Double Free in CI/CD Regex Parsing

GitLab CE/EE contains a double free (CWE-415) memory corruption flaw in the code that parses regular expressions in CI/CD pipeline configurations. An authenticated attacker — for example a user who can create a project or edit a .gitlab-ci.yml file containing a specially crafted regular expression — can trigger the bug during config parsing and execute arbitrary code on the GitLab server itself. The CVSS 3.1 base score is 9.9 (critical), reflecting low-privilege authentication requirements but full compromise of server confidentiality and integrity with scope change, since code runs outside the application's normal context. All self-managed installations from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 are affected; GitLab.com (the vendor's SaaS offering) is centrally managed and not exposed to unpatched customer instances. There is no known public proof-of-concept, the issue is not on the CISA KEV list, and no exploitation has been reported, though GitLab instances are high-value targets for source-code and secrets theft.

Do: Upgrade self-managed instances immediately to 19.2.7, 19.3.3, or 19.4.1 (or later) matching your minor release track. Until patched, restrict who can create projects or edit CI/CD configuration files, and review recent .gitlab-ci.yml commits for unusual or overly complex regular expressions. Audit GitLab server logs and CI/CD job history for anomalous pipelines or unexpected process activity originating from the GitLab application host.

9.9

—

GitLab Community Edition (CE) >= 19.2 and < 19.2.7; >= 19.3 and < 19.3.3; >= 19.4 and < 19.4.1
GitLab Enterprise Edition (EE) >= 19.2 and < 19.2.7; >= 19.3 and < 19.3.3; >= 19.4 and < 19.4.1

CVE-2026-97229

Unauthenticated RCE in GitLab CE/EE via CI/CD regex

GitLab remediated a critical flaw in GitLab Community Edition and Enterprise Edition in which insufficient validation of a regular expression in CI/CD configuration can let an unauthenticated remote attacker run arbitrary code on the GitLab server under certain conditions. The issue is triggered by a specially crafted regular expression supplied through CI/CD configuration and does not require a logged-in user. Successful exploitation yields full confidentiality, integrity, and availability impact on the server, with a changed scope (CVSS 3.1 10.0). It affects all 19.2 releases before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. It is not listed in CISA KEV and no public proof-of-concept is known.

Do: Upgrade self-managed GitLab CE/EE to 19.2.8, 19.3.5, or 19.4.2 (or any later release on a supported line). Until patched, keep the instance off the public internet, restrict who can reach the web UI and API, and review recent CI/CD configuration changes for unexpected regular expressions.

10.0

<1%

PoC ×4

GitLab CE/EE 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2

large