GitLab RCE CVE-2026-110264 patched after 12-year flaw exposure

1. Executive summary

GitLab patched CVE-2026-110264, an integer overflow in regular-expression compilation that allows an unauthenticated attacker to execute arbitrary code on self-managed GitLab Community Edition and Enterprise Edition servers, with affected releases dating back to GitLab 7.0 (June 2014). NVD records the flaw at CVSS 10.0 CRITICAL, CWE-190; it is not in CISA KEV and EPSS sits at 1 percent, consistent with no confirmed in-the-wild exploitation at the time of writing. GitLab.com and GitLab Dedicated are already patched, so exposure is confined to self-managed instances. For EMEA financial services the risk is concentrated in self-hosted GitLab instances that hold source code, CI/CD configuration, deployment secrets and production credentials: server-level compromise puts those assets and the downstream supply chain in scope, and the 1 percent EPSS should be read as a pre-scanning baseline, not a reason to defer.

2. Regulatory framing

3. Technical analysis & attack chain

The vulnerability is an integer overflow (CWE-190) in the regular-expression compiler used by GitLab CE and EE. GitLab's release notes state that "under certain conditions" it "could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression." The affected range runs from GitLab 7.0, released June 2014, through the versions fixed on 21 October 2026.

Confirmed steps, drawn from the vendor release notes and the Rapid7 analysis of the closely related CVE-2026-97229 (same component, same CWE, same CVSS, fixed nine days earlier):

1. The attacker places a specially crafted regular expression where GitLab will compile it. In the Rapid7 reproduction of CVE-2026-97229 the delivery path was a malicious .gitlab-ci.yml committed to a branch in a public project, together with a repository path containing UTF-8 characters.
2. The crafted expression compiles in a compact US-ASCII representation and passes GitLab's regular-expression validation.
3. When the expression is evaluated against a valid UTF-8 repository path, Ruby's Onigmo engine recompiles it for the new encoding after validation has completed.
4. An integer overflow in the compiler's program-size calculation generates invalid regular-expression instructions.
5. The resulting loss of control-flow integrity lets the attacker execute Onigmo VM operations in the Ruby process and run an operating system command as the GitLab git user.

Rapid7 validated the full chain against the official GitLab 19.4.1 CE Linux amd64 image with ASLR enabled, and the same input did not execute against the patched 19.4.2 image. That reproduction is for CVE-2026-97229; no equivalent public reproduction of CVE-2026-110264 has been published, and the two should not be treated as identical without verification.

The authentication caveat matters. GitLab's CVSS vector for the sibling flaw scores it as requiring no privileges, but Rapid7 found the attacker must first be able to commit a malicious CI/CD configuration and a UTF-8 repository path to a public project. On instances that allow self-registration and public project creation, that prerequisite is met by an ordinary account. On locked-down instances it is not, which lowers but does not remove exposure.

Fixed versions: 19.5.1, 19.4.3, 19.3.6, with backports to 19.2.9, 19.1.9, 19.0.10 and 18.11.13. Administrators who applied the 12 October update (19.2.8, 19.3.5, 19.4.2) are still exposed to CVE-2026-110264, because the new fixed versions sit one patch above that release and the October 12 update covered only 19.2 and later. GitLab also published two threat detections for self-managed customers.

Impact if exploited: SOC Prime notes that GitLab repositories hold source code, CI/CD configuration, deployment secrets, access tokens, infrastructure definitions and production connections, so server compromise creates paths to credential theft, repository manipulation, supply chain attack, persistence and lateral movement. That assessment is single-sourced commentary from a detection vendor, not an observation from an incident.

No in-the-wild exploitation of CVE-2026-110264 is confirmed. The Register expects scanning to begin soon; that is expectation, not evidence. No threat actor is named in any source and no MITRE ATT&CK profile applies, so there is no attribution to make.

4. Mitigation & containment

P1, within 24 hours:

• Upgrade every self-managed GitLab CE/EE instance to 19.5.1, 19.4.3 or 19.3.6, or to the backport matching your track (19.2.9, 19.1.9, 19.0.10, 18.11.13). Do not treat 19.2.8, 19.3.5 or 19.4.2 as fixed for this CVE.
• If upgrade cannot complete inside 24 hours, restrict anonymous access to public projects and prevent untrusted users from creating or writing to public projects. Rapid7 states these controls address only the demonstrated delivery path and do not remediate the vulnerable compiler.
• Deploy the two GitLab threat detections published for self-managed customers.

P2, within 72 hours:

• Inventory all GitLab instances, including forgotten or departmental deployments, and confirm version numbers against the fixed list. Instances older than 19.2 need an upgrade path assessment because the backports stop at 18.11.13.
• Review GitLab audit and application logs for commits of .gitlab-ci.yml to public projects by low-trust or newly registered accounts, and for repository paths containing non-ASCII UTF-8 characters.
• Rotate CI/CD variables, runner registration tokens, deploy keys and any credentials reachable from affected instances if an instance was exposed and unpatched.

P3, within 7 days:

• Disable self-registration and public project creation on instances that do not require them, which removes the prerequisite Rapid7 identified.
• Add GitLab version checks to vulnerability management so future advisories are matched against the actual deployed version, not the release channel.

5. Indicators of compromise

No indicators of compromise available in the source material. The sources describe no hashes, domains, IP addresses, file paths or command strings specific to CVE-2026-110264. GitLab's two threat detections are referenced but their contents are not reproduced in any source, so they cannot be listed here.

Behavioural indicators:

6. Detection

Insufficient indicators to author detection rules. The sources give no artefact strings, command-line flags, filenames, registry keys or network patterns specific to CVE-2026-110264. The .gitlab-ci.yml filename and the git user are generic GitLab components, not artefacts of this threat, and a rule built on them would fire on legitimate activity. Use the two GitLab threat detections referenced in the vendor release notes once obtained.

CVE assessment

1 referenced CVE — 1 critical (CVSS ≥ 9.0)

7. Sources

• The Register, "Max-severity GitLab bug allows remote code execution over 12 years of releases", 2026-10-22. https://www.theregister.com/security/2026/10/22/max-severity-gitlab-bug-allows-remote-code-execution-over-12-years-of-releases/5304854
• Rapid7, "CVE-2026-97229: Critical Unauthenticated Remote Code Execution in GitLab", 2026-10. https://www.rapid7.com/blog/post/etr-cve-2026-97229-critical-unauthenticated-remote-code-execution-in-gitlab
• Help Net Security, "GitLab admins urged to patch critical RCE flaw (CVE-2026-97229)", 2026-10-13. https://www.helpnetsecurity.com/2026/10/13/gitlab-ci-cd-regular-expression-compiler-vulnerability-cve-2026-97229/
• The Hacker News, "Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases", 2026-10. https://thehackernews.com/2026/10/critical-gitlab-flaw-cvss-100-could.html
• The Hacker News, "GitLab Patches CVSS 10.0 Flaw That Could Let Unauthenticated Users Run Server Code", 2026-10. https://thehackernews.com/2026/10/gitlab-patches-cvss-100-flaw-that-could.html
• ANSSI CERT-FR, "Multiples vulnérabilités dans GitLab", CERTFR-2026-AVI-1294, 2026-10-12. https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1294/
• Help Net Security, "Critical GitLab flaw allows attackers to modify or delete public projects (CVE-2026-19478)", 2026-08-18. https://www.helpnetsecurity.com/2026/08/18/gitlab-critical-code-injection-flaw-cve-2026-19478/

8. Adverse Trace position

Adverse Trace assesses CVE-2026-110264 at CVSS 10.0 CRITICAL as recorded by NVD, not in CISA KEV, with EPSS at 1 percent. The severity is unambiguous; the exploitation status is not yet. No in-the-wild activity is confirmed and no actor is attributed. The technical mechanism is corroborated across the vendor release notes and Rapid7's reproduction of the sibling CVE-2026-97229, but the specific exploit chain for CVE-2026-110264 rests on the vendor description alone, and the impact narrative from SOC Prime is single-sourced and should be verified before it is used in a board paper. Clients running self-managed GitLab should treat the upgrade as a P1 action and confirm they are on 19.5.1, 19.4.3, 19.3.6 or the matching backport, not the 12 October release. We will monitor CISA KEV and EPSS for movement on this CVE, watch for a published technical analysis from Rapid7, and reissue this advisory if exploitation is confirmed or the EPSS score rises materially.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.