Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases

CVE-2026-110264 is a GitLab security flaw rated 10.0, the highest possible severity. It can let someone run their own commands on a self-managed GitLab server without signing in. That makes it dangerous because an attacker may gain control before administrators know who they are.

In a real example, an attacker could submit a specially designed regular expression to GitLab. During compilation, Ruby’s built-in Onigmo engine can suffer an integer overflow, triggering code execution. GitLab has not disclosed the exact conditions needed to reach this compiler, so configuration cannot reliably exclude an installation.

GitLab released fixes October 21 for every branch back to version 7.0, released in 2014. Administrators should upgrade, because the October 12 fix covered only versions 19.2 and newer. GitLab reports no attacks, and CISA had not listed it by October 22. Detection rules exist, but the fix remains the only certain protection.

Every self-managed GitLab installation from 7.0 onward is affected by CVE-2026-110264. It can let an unauthenticated attacker run code through a specially crafted regular expression, earning a maximum 10.0 severity rating.

For example, an administrator running 19.2.8, 19.3.5, or 19.4.2 must upgrade again. Those versions received the October 12 fix, but this newer flaw still affects them. Install 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, or 18.11.13, matching your release branch.

Only self-managed sites need action. GitLab.com is already fixed, and Dedicated tenants need 19.3.5-internal0 or 19.4.2-internal0, or later. GitLab reports no exploitation, but offers no workaround; 19.4.3 and 19.3.6 may cause single-node downtime during database changes.

It reaches back to GitLab 7.0 because the vulnerable component is not new GitLab application code. GitLab ships Ruby’s Onigmo regular-expression engine inside its own packages, and that engine has been present in every release since 2014. A weakness in that shared component therefore traveled across the release history.

For example, CVE-2026-110264 involves an integer overflow when Onigmo compiles a specially crafted regular expression. Under conditions GitLab has not disclosed, an unauthenticated attacker could run arbitrary code on a self-managed server. The same researcher reported an earlier flaw on October 12. That issue stopped at version 19.2. CVE-2026-110264 reaches older branches because the underlying engine remained bundled there.

GitLab released fixes for seven branches on October 21, including backports to 18.11.13, 19.0.10, 19.1.9, and 19.2.9. Administrators cannot dismiss the risk based on configuration, because GitLab has not disclosed the required conditions. Patching is the only certain protection; GitLab.com already runs a fixed version, while self-managed installations must upgrade.

Onigmo is Ruby’s built-in regular-expression engine, the software that compiles search patterns into instructions GitLab can run. GitLab ships Onigmo inside its own packages and patches those builds. That means the weakness reached GitLab releases back to version 7.0.

A specially crafted regular expression can drive the compiler into an unsafe integer calculation. The calculation can exceed the integer’s limit, creating an overflow while the pattern is compiled. The source does not identify the exact pattern, calculation, or other conditions needed to trigger it.

In this case, CVE-2026-110264 could let an unauthenticated user run arbitrary code on a self-managed server. GitLab rated it 10.0 and reported no evidence of attacks. The October 21 fixes cover seven branches, including versions older than its normal support range. Administrators cannot exclude risk through configuration, because GitLab has not disclosed the prerequisites. It offers no temporary workaround, making the fixed release the only certain protection.

Upgrading is the only certain protection because GitLab has not disclosed the conditions needed to reach the vulnerable compiler. Administrators cannot confirm that their configuration blocks the attack, and GitLab offers no interim workaround. The flaw sits in Onigmo, Ruby’s regular-expression engine, shipped in GitLab packages since version 7.0.

For example, CVE-2026-110264 could let an unauthenticated attacker run code by triggering an integer overflow while compiling a crafted regular expression. This means login requirements do not reliably protect an exposed self-managed installation. Installing a fixed release addresses the vulnerable component directly, rather than relying only on detection rules.

The October 21 fixes include versions 19.4.3 and 19.3.6, which perform database changes during upgrading. On a single-node server, those changes require downtime while they complete. Multi-node deployments can use GitLab’s zero-downtime procedure, while GitLab.com already runs a fixed version.

Regular expressions are compact patterns that search, match, or transform text, such as finding an email-like string. The software first turns that pattern into an internal plan. It then runs the plan against input, testing characters, repetitions, groups, and alternatives.

GitLab's Ruby-based Onigmo engine illustrates the risk. Its compiler processes specially crafted patterns, and a flawed integer calculation can overflow, causing unsafe behavior before or during execution. GitLab ships and patches Onigmo in its packages. Therefore, the weakness reached every GitLab release containing it, from version 7.0 onward.

On October 21, GitLab fixed CVE-2026-110264, a maximum-severity 10.0 flaw allowing unauthenticated code execution under certain conditions. The issue affected self-managed installations, while GitLab.com already ran a fixed version. This shows why runtime and library fixes matter: one shared component can require emergency updates across many application versions.