GitLab: 11 Vulnerabilities Disclosed, Including Critical RCE Affecting 12 Years of Versions
GitLab Inc. disclosed 11 vulnerabilities on October 22, 2026, including a critical RCE flaw affecting versions dating back 12 years, prompting urgent patching.
Key findings
- GitLab released patches for 11 vulnerabilities on October 22, 2026, affecting CE/EE versions from 7.0 to 19.5.
- A critical RCE vulnerability (CVE-2026-110264, CVSS 10.0) affects versions dating back 12 years.
- Multiple flaws involve authentication bypass, authorization issues, and information disclosure.
- Patched versions include 19.5.1, 19.4.3, 19.3.6, and others down to 18.11.13.
- Users are urged to upgrade immediately to mitigate risks across a wide range of severities.
On October 22, 2026, GitLab Inc. disclosed a batch of 11 vulnerabilities affecting both GitLab Community Edition (CE) and Enterprise Edition (EE). These vulnerabilities, patched in a coordinated release on October 21, 2026, span a range of severities from Low to Critical, with the most severe flaw, CVE-2026-110264, carrying a CVSS score of 10.0. The disclosures highlight potential security risks for self-managed GitLab instances, with some vulnerabilities affecting versions dating back to 2014.
Several vulnerabilities revolve around authentication and authorization bypasses. CVE-2026-15723, a High severity flaw, could allow an authenticated user to take over an existing LDAP-backed account when OmniAuth SAML and LDAP auto-linking are enabled. Similarly, CVE-2026-16255 (Medium) enables an authenticated user to grant or accept project and group membership outside of the identity provider's control when instance-wide SAML or LDAP membership lock is enabled. Another High severity vulnerability, CVE-2026-112212, could allow an unauthenticated user to poison a shared cache's OAuth/OIDC discovery document, potentially redirecting flows to an externally controlled server.
Information disclosure and policy bypasses are also present in this batch. CVE-2026-13319 (Medium) allows an authenticated user to read metadata from arbitrary private projects. CVE-2026-12664 (Medium) enables an authenticated user with a read_api-scoped token to retrieve a project's incoming email address and create work items, bypassing intended restrictions. A bypass of merge request approval policies on protected branches is possible via CVE-2026-14288 (Low) under certain conditions.
The batch also includes vulnerabilities related to feature access and data integrity. CVE-2026-112378 (Medium) could allow an authenticated user to access paid AI features without a valid subscription due to insufficient server-side validation. CVE-2026-112326 (Low) permits an authenticated user with read-only permissions to permanently delete vulnerability records due to improper cleanup logic. Furthermore, CVE-2026-105711 (Low) could allow an authenticated user with no project membership to read confidential issues from private projects when referenced in a public project's merge request. Lastly, CVE-2026-103515 (Low) allows an authenticated user with group Owner permissions to re-enable AI-backed data egress to a third-party service after an administrator has locked Duo availability.
The most critical vulnerability, CVE-2026-110264 (Critical, CVSS 10.0), could allow an unauthenticated user to execute arbitrary code on the server. This flaw affects versions from 7.0 up to the latest releases, indicating a long-standing potential for exploitation. While GitLab has released patches for all these issues, including versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13, users are strongly urged to upgrade immediately. GitLab.com and GitLab Dedicated tenants are already running patched versions.
The coordinated disclosure of these 11 vulnerabilities underscores the importance of timely patching for self-managed GitLab instances. The wide range of affected versions, particularly for the critical RCE vulnerability, means that administrators who have not updated recently may be at significant risk. Users should prioritize applying the latest security updates to mitigate these diverse threats. The disclosure was covered by multiple security news outlets, highlighting the severity and broad impact of these flaws. Cyber Security News The Hacker News