Executive Summary

On October 21st, 2026, GitLab released a critical patch for CVE-2026-110264 (CVSS 10.0), an integer overflow in the regular expression compiler of GitLab Community Edition and Enterprise Edition. Under conditions GitLab has not disclosed, the flaw lets an unauthenticated, remote attacker execute arbitrary code on a self-managed GitLab server.

GitLab reports no exploitation in the wild at the time of writing, and the vulnerability is not in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, this is the fourth code execution flaw in GitLab's regex engine reported in roughly a month, and GitLab offers no workaround or mitigation steps. GitLab servers hold source code, CI/CD credentials, and deployment secrets, so Beazley Security recommends affected organizations apply available fixes immediately.

The same release fixes 11 security issues in total, including two high-severity authentication flaws, CVE-2026-15723 (CVSS 8.2) and CVE-2026-112212 (CVSS 7.5), covered under Technical Details below.

Affected Systems or Products

Product

Affected Versions

Fixed Versions

GitLab CE and EE

7.0 through 18.11.12

18.11.13

GitLab CE and EE

19.0.0 through 19.0.9

19.0.10

GitLab CE and EE

19.1.0 through 19.1.8

19.1.9

GitLab CE and EE

19.2.0 through 19.2.8

19.2.9

GitLab CE and EE

19.3.0 through 19.3.5

19.3.6

GitLab CE and EE

19.4.0 through 19.4.2

19.4.3

GitLab CE and EE

19.5.0

19.5.1

Versions above apply to CVE-2026-110264. Affected ranges for the two high-severity CVEs are listed under Technical Details.

Mitigations / Workarounds

To address this vulnerability, upgrade self-managed GitLab CE and EE instances to the fixed version for the release branch already in use. Multi-node deployments can use GitLab's zero-downtime upgrade procedure. Some releases include database migrations, which cause downtime on single-node instances.

GitLab has not disclosed the conditions required to reach the vulnerable regex compiler, and it offers no workaround. Configuration alone cannot rule an instance out, so upgrading is the only reliable fix. Until an upgrade is complete, the following steps may reduce exposure:

  1. 1.

    Restrict network access to the GitLab instance, removing it from public internet exposure or limiting connectivity to trusted IP ranges.

  2. 2.

    Confirm the running version of each instance directly rather than assuming a branch is current, since instances patched on October 12th, 2026, are affected by the newly reported vulnerabilities.

For CVE-2026-15723, prioritize instances where both OmniAuth SAML and LDAP auto-linking are enabled. For CVE-2026-112212, prioritize deployments that serve OAuth/OIDC discovery responses through a shared cache.

Patches

GitLab.com is already running the fixed version. GitLab Dedicated tenants on 19.3.5-internal0, 19.4.2-internal0, or later already include the fixes and require no customer action. GitLab has released fixes for self-managed installations, and upgrade details are available in the vendor's patch release notes linked below.

Indicators of Compromise

At the time of writing, GitLab reports no exploitation in the wild. Given the pace of research against this component, Beazley Security expects that status could change quickly.

GitLab published two detection rules for self-managed administrators as part of its open-source TLDR framework, written in Sigma format against GitLab application logs:

Organizations should deploy both rules and review historical logs for matching events. Unexpected worker crashes or bursts of rendering errors on an internet-facing instance should be treated as suspicious, particularly while the instance was unpatched.

Follow any suspected exploitation with a credential review. Watch for unexpected CI/CD job runs, new or modified deploy tokens and personal access tokens, unfamiliar processes spawned by the GitLab service account, and use of GitLab-held secrets against connected cloud or registry accounts.

Technical Details

The highest impact critical vulnerability (CVE-2026-110264) resides in Onigmo, Ruby's built-in regular expression engine, which GitLab ships and patches within its own packages. Compiling a specially crafted regular expression triggers an integer overflow that can lead to arbitrary code execution. Because the engine is bundled in every release since 7.0, the affected range spans roughly twelve years of GitLab versions.

GitLab describes the issue as exploitable "under certain conditions" but has not identified them. The published CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C) indicates network reachability with no authentication or user interaction.

The vulnerabilities rated at high are in different subsystems.

CVE-2026-15723 (CVSS 8.2): When OmniAuth SAML and LDAP auto-linking are both enabled, improper input sanitization in the LDAP email lookup path lets an authenticated user take over an existing LDAP-backed account without interaction from the targeted user. Affected versions are 10.1 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1.

CVE-2026-112212 (CVSS 7.5): Improper trust of user-supplied values when building endpoint URLs in cached OAuth/OIDC discovery responses lets an unauthenticated attacker poison a shared cache and redirect certain sign-in flows to an attacker-controlled server. Affected versions are 18.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1.

How Beazley Security is responding

Beazley Security is monitoring client perimeter devices through our Exposure Management Platform to identify impacted devices and support organizations in remediation of any issues found.

We are also conducting threat hunts across our MDR environment to detect potential exploitation attempts against our clients.

If you believe your organization may have been impacted by this attack campaign and need support, please contact our Incident Response team.

Sources