Glonce

GitLab 19.5.1 patches CVSS 10.0 unauthenticated code execution bug

securityThe Glonce editorsHacker News🔥71Glonce rating71Impact65Novelty40Relevance72Surprise40Players60Credibility95

On October 21, 2026, GitLab released critical patch versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13 for Community Edition (CE) and Enterprise Edition (EE). The company says the versions contain important bug and security fixes and that it strongly recommends all self-managed installations be upgraded to one of them immediately. GitLab.com already runs the patched version. GitLab Dedicated tenants on 19.3.5-internal0 and 19.4.2-internal0 or later already include the fixes and need take no action.

The headline fix is CVE-2026-110264, an integer overflow in the regular expression compiler. GitLab says that under certain conditions it could have allowed an unauthenticated user to execute arbitrary code on the GitLab server by getting it to compile a specially crafted regular expression. It is scored CVSS 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), the maximum. It affects GitLab CE/EE from 7.0 up to the fixed releases: before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1. In addition to the standard patch releases, GitLab backported this fix to 18.11.13, 19.0.10, 19.1.9 and 19.2.9. The reporter, credited by the handle joaxcar, found it through GitLab's HackerOne bug bounty program. GitLab security has also released two threat detections to help self-managed customers spot exploitation attempts of this CVE.

The advisory lists twelve vulnerabilities in total. The next most severe ones:

CVE-2026-15723 (CVSS 8.2, CE/EE, from 10.1): improper authentication. When OmniAuth SAML and LDAP auto-linking were both enabled, an authenticated user could have taken over an existing LDAP-backed account with no interaction from the targeted user, because of improper input sanitization in the LDAP email lookup used during OmniAuth identity linking.

CVE-2026-112212 (CVSS 7.5, CE/EE, from 18.3): cache poisoning. Under certain conditions an unauthenticated user could have poisoned a shared cache's OAuth/OIDC discovery document to redirect certain flows to an externally controlled server. GitLab team member Peter Arts found it internally.

CVE-2026-12664 (CVSS 6.8, CE/EE, from 18.2): an authenticated user with a read_api-scoped token could have retrieved a project's incoming email address and created work items, bypassing the token's restrictions, because a GraphQL field did not enforce scope.

CVE-2026-16255 (CVSS 5.9, EE only, from 12.0): when the instance-wide SAML or LDAP membership lock was enabled, an authenticated user could have granted or accepted project and group membership outside the identity provider's control, for requests created before the lock was enabled.

Three flaws are scored CVSS 4.3. CVE-2026-105777 (CE/EE, from 17.6.5) could let an unauthenticated user retrieve sensitive internal server credentials through improperly filtered internal response headers. CVE-2026-13319 (CE/EE, from 15.10) could let an authenticated user read milestone metadata, including titles, descriptions and full project paths, from arbitrary private projects through the group milestones API. CVE-2026-112378 (EE only, from 17.8) could let an authenticated user use paid AI features without a valid subscription; GitLab team member Halil Coban found it internally.

The rest are lower: CVE-2026-105711 (CVSS 3.5, CE/EE, from 15.0) could expose the title of a confidential issue from a private project through a shared merge request fragment cache. CVE-2026-14288 (CVSS 3.1, EE only, from 17.4) could let an authenticated user bypass a required merge request approval policy on a protected branch. CVE-2026-112326 (CVSS 3.1, EE only, from 17.8) could let a user with read-only permissions permanently delete existing vulnerability records; GitLab team member Gregory Havenga found it internally. CVE-2026-103515 (CVSS 2.7, EE only, from 19.2), the lowest in the list, could let a group Owner re-enable AI-backed data egress to a third-party service after an instance administrator had locked the group's Duo availability. For all of the EE-only and CE/EE fixes, the patched versions are 19.3.6, 19.4.3 and 19.5.1.

The 19.5.1 bug-fix list includes a Ruby regexp repeat ID overflow patch for Ruby 3.3, 3.4 and 4.0, alongside routine backports such as docs pages, release notes and a CNG helm chart bump to v10.5.0.

GitLab also restates its process: scheduled patch releases come twice a month on the second and fourth Wednesdays, with ad-hoc critical patches for high-severity vulnerabilities, and issues detailing each security fix are made public on its issue tracker 90 days after the release that patched them.

Key facts

  • GitLab released 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13 for CE and EE on October 21, 2026, and strongly recommends all self-managed installations upgrade immediately.
  • CVE-2026-110264 is an integer overflow in the regular expression compiler, scored CVSS 10.0, that under certain conditions could let an unauthenticated user execute arbitrary code on the GitLab server.
  • It affects all CE/EE versions from 7.0 before the fixed releases; the fix was backported to 18.11.13, 19.0.10, 19.1.9 and 19.2.9 beyond the standard patches.
  • The advisory covers twelve CVEs, from CVSS 10.0 down to 2.7, including an account takeover via SAML and LDAP auto-linking (CVSS 8.2) and OAuth/OIDC cache poisoning (CVSS 7.5).
  • GitLab.com is already patched, GitLab Dedicated tenants on 19.3.5-internal0 and 19.4.2-internal0 or later need no action, and GitLab released two threat detections for self-managed customers.

Why it matters

A CVSS 10.0 score with no authentication required (PR:N, UI:N) and a network attack vector is the worst case on the scale, and it hits the server that holds source code, CI pipelines and credentials. The affected range is very wide: every CE/EE version from 7.0 up to the fixed releases. GitLab also took the unusual step of backporting the fix to four older release lines (18.11, 19.0, 19.1, 19.2) beyond the standard patch releases, and issued threat detections for exploitation attempts.

Who it affects

Anyone running self-managed GitLab CE or EE on a version below 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3 or 19.5.1 for their release line. Several of the lower-severity fixes touch EE only: the SAML/LDAP membership lock, AI feature billing checks, merge request approval policies, security findings and Duo admin-lock for Amazon Q. GitLab.com users need to do nothing, and neither do GitLab Dedicated tenants on 19.3.5-internal0 and 19.4.2-internal0 or later.

How to use it

Upgrade each self-managed instance to the patched version for its release line: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 or 18.11.13. GitLab says to do it immediately. Self-managed customers can also use the two threat detections GitLab security released to look for attempts to exploit CVE-2026-110264. When the advisory names no deployment type (omnibus, source, helm chart and so on), all types are affected.

How solid is it

This is GitLab's own first-party release notice, with CVE numbers, affected version ranges and full CVSS 3.1 vectors for each issue. Reporters are credited by HackerOne handle for most of the external findings, and three issues were found internally by named GitLab team members. The notice does not say that CVE-2026-110264 is being exploited in the wild; it says only that threat detections for exploitation attempts were released. It also gives no proof-of-concept or technical detail of the regex compiler overflow.

Risks and caveats

GitLab describes the code execution flaw only as possible under certain conditions and does not say what those conditions are, so do not assume your instance is safe because you think you do not meet them. No workaround other than upgrading is described. Technical details of each issue are due to be published on the issue tracker 90 days after the release, so more information about the bugs will become public later. Some of the other flaws depend on configuration, for example CVE-2026-15723 needs OmniAuth SAML and LDAP auto-linking both enabled.

“we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately”

— GitLab, patch release notice