GitLab administrators who patched their servers on October 12 need to update them again. A second maximum-severity vulnerability affects installations running those earlier fixes.
On October 21, 2026, GitLab released patches for CVE-2026-110264, a remote code execution (RCE) flaw affecting self-managed Community Edition (CE) and Enterprise Edition (EE) installations. Rated 10.0 under CVSS 3.1, the vulnerability could allow unauthenticated attackers to execute arbitrary code under certain conditions.
Unlike CVE-2026-97229, patched nine days earlier, the new GitLab RCE vulnerability affects releases dating back to 2014. Even organizations that installed the October 12 fixes must update again.
New GitLab RCE flaw affects releases dating back to 2014
According to GitLab's October 21 security advisory, CVE-2026-110264 involves an integer overflow when compiling a specially crafted regular expression. Successful exploitation could compromise an affected server without requiring valid credentials.
Censys' October 22 analysis identifies Org-mode (.org) file rendering in public projects as a potential attack path. Exploitation could execute code under GitLab's git account, potentially exposing repositories and CI/CD credentials.
The earlier CVE-2026-97229 flaw involved regular-expression validation in CI/CD configurations. Both vulnerabilities carry CVSS scores of 10.0 but require separate fixes. Versions 19.4.2, 19.3.5, and 19.2.8 remain affected by the newer flaw.
Other recent GitLab security issues include an August GraphQL vulnerability, a September flaw added to CISA's exploited vulnerabilities catalog, and an October AI Gateway command-execution flaw. These involved separate security weaknesses.
On October 21, Censys identified 81,820 internet-visible GitLab hosts. More than half were estimated to be running release lines over seven months old, although the findings do not establish how many installations were vulnerable or compromised. As of October 22, Censys had identified no confirmed exploitation in the wild or verified public proof-of-concept code for CVE-2026-110264.
Affected GitLab versions and patch guidance
GitLab issued seven fixed releases, including four additional backports for older CE and EE versions.
| Affected versions | Fixed version |
|---|---|
| 19.5.0 | 19.5.1 |
| 19.4 before 19.4.3 | 19.4.3 |
| 19.3 before 19.3.6 | 19.3.6 |
| 19.2 before 19.2.9 | 19.2.9 |
| 19.1 before 19.1.9 | 19.1.9 |
| 19.0 before 19.0.10 | 19.0.10 |
| 7.0 through 18.11.12 | 18.11.13 or a later applicable fixed release |
Older installations should follow GitLab's upgrade guidance. Some updates require database migrations and may cause downtime on single-node systems. GitLab.com and appropriately patched GitLab Dedicated installations already have the fixes.
GitLab also published two detections: "Onigmo native worker crash" and "Org mode render error burst." CERT-EU's October 22 advisory recommends prioritizing internet-facing systems and assessing possible compromises.
Security teams should:
- Identify affected installations: Inventory GitLab versions across production, development, and testing systems.
- Install security updates: Apply fixed releases, verify versions, and check backups before upgrading.
- Reduce unnecessary exposure: Restrict public access where feasible and limit sensitive network connections.
- Investigate suspicious activity: Check rendering errors, unexpected processes,
gitaccount activity, and SSH key changes. - Assess potential compromise: Review credentials, repositories, and pipelines. Rotate exposed secrets where necessary.
- Test incident response plans: Validate isolation, evidence preservation, credential rotation, and recovery procedures.
Monitoring and access restrictions may reduce exposure, but they do not eliminate the vulnerability. Administrators must install an applicable fixed release, even if they updated earlier in October.
Read more: The Coder registry compromise involving malicious Terraform modules shows how attacks against development infrastructure can expose cloud credentials and CI/CD secrets.