VYPR
Published Oct 22, 2026· 1 source

GitLab: Seven Vulnerabilities Patched, Including Critical 12-Year-Old RCE Flaw

Key findings • GitLab released patches for seven vulnerabilities on October 22, 2026, affecting CE/EE versions from 7.0 to 19.5. • A critical RCE vulnerability (CVE-2026-110264, CVSS 10.0) af…

Key findings

  • GitLab released patches for seven vulnerabilities on October 22, 2026, affecting CE/EE versions from 7.0 to 19.5.
  • A critical RCE vulnerability (CVE-2026-110264, CVSS 10.0) affects versions dating back 12 years.
  • Multiple flaws involve authentication bypass, authorization issues, and information disclosure.
  • Patched versions include 19.5.1, 19.4.3, 19.3.6, and others down to 18.11.13.
  • Users are urged to upgrade immediately to mitigate risks across a wide range of severities.

On October 22, 2026, GitLab Inc. disclosed seven vulnerabilities affecting both GitLab Community Edition (CE) and Enterprise Edition (EE). These vulnerabilities, patched in a coordinated release on October 21, 2026, span a range of severities from Low to Critical, with the most severe flaw carrying a CVSS score of 10.0. The disclosures highlight a critical remote code execution (RCE) vulnerability that affects versions dating back approximately 12 years.

One of the most significant vulnerabilities, CVE-2026-110264, is a critical RCE flaw with a CVSS score of 10.0. This vulnerability, affecting versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1, could allow an unauthenticated user to execute arbitrary code on the server. This is due to an integer overflow when the server compiles a specially crafted regular expression. This vulnerability has been noted for its long history, with affected code reaching back to GitLab 7.0, released in 2014.

Another high-severity vulnerability, CVE-2026-15723 (CVSS 8.2), allows an authenticated user to take over an existing LDAP-backed account when OmniAuth SAML and LDAP auto-linking are both enabled. This affects all versions from 10.1 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1.

Several medium-severity vulnerabilities were also addressed. CVE-2026-13319 (CVSS 4.3) allows an authenticated user to read milestone metadata, including titles, descriptions, and full project paths, from arbitrary private projects. CVE-2026-12664 (CVSS 6.8) could allow an authenticated user with a read_api-scoped token to retrieve a project's incoming email address and create work items, bypassing certain restrictions. CVE-2026-105777 (CVSS 4.3) allows an unauthenticated user to retrieve sensitive internal server credentials due to improper filtering of internal response headers.

Additionally, CVE-2026-112212 (CVSS 7.5) is a high-severity vulnerability that could allow an unauthenticated user to poison a shared cache's OAuth/OIDC discovery document, redirecting certain flows to an externally controlled server. Finally, a low-severity vulnerability, CVE-2026-105711 (CVSS 3.5), could allow an authenticated user with no project membership to read confidential issue details if a merge request in a public project references a confidential issue from a private project.

GitLab addressed these vulnerabilities through patch releases including 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13. The company strongly recommends that all self-managed GitLab installations be upgraded immediately to one of these versions. GitLab.com is already running the patched version, and GitLab Dedicated tenants on specific versions also include these fixes. While the critical CVE-2026-110264 has a long history, GitLab's advisory does not report confirmed attacks or provide a public exploit.

These vulnerabilities underscore the importance of timely patching, especially for critical flaws like the RCE in CVE-2026-110264, which has a wide-reaching impact due to its extensive version coverage. Users are urged to apply the latest patches to protect their instances from potential exploitation.

The disclosure of these seven vulnerabilities, including a critical RCE affecting versions dating back 12 years, emphasizes the ongoing need for vigilance in securing GitLab instances. The patched versions are 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13.

The critical RCE vulnerability, CVE-2026-110264, is particularly concerning due to its CVSS score of 10.0 and its impact on versions from 7.0 onwards.

Other notable vulnerabilities include an account takeover flaw (CVE-2026-15723) and an information disclosure vulnerability (CVE-2026-105777).

Users should prioritize upgrading to the latest patched versions to mitigate these risks.

Synthesized by Vypr AI