Elena Abrazhevich - Adobe

News

Max-severity GitLab flaw lets attackers run code on servers

A high-impact GitLab flaw lets unauthenticated attackers run code on self-managed servers. Every release since 2014 is affected.

Alissa Irei
By
Published: 22 Oct 2026

A security researcher has uncovered a new maximum-severity security flaw that could let unauthenticated remote attackers run code on self-managed GitLab servers -- across releases dating back to 2014.

GitLab released a patch for CVE-2026-110264 on Wednesday, Oct. 21, crediting bug hunter Johan "joaxcar" Carlsson with finding and reporting the flaw through GitLab's HackerOne bug bounty program.

According to the patch release note, the Regular Expression Compiler issue -- which has a CVSS rating of 10.0 -- "could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression."

Beyond the standard patch releases, GitLab also backported the fix to four additional branches -- 18.11.13, 19.0.10, 19.1.9 and 19.2.9.

"GitLab almost never patches branches this old," wrote security analyst Mario Ariel Galarza Mancedo on LinkedIn. "That tells you how serious this is."

According to GitLab, more than half of the Fortune 100 use its DevSecOps platform. Because self-hosted GitLab servers often contain sensitive data such as proprietary source code, CI/CD secrets, access tokens and connections to production environments, the flaw's potential impact on enterprises is significant.

According to analysis by threat detection firm SOC Prime, exploitation could lead to credential theft, repository manipulation, supply chain attacks, persistence or lateral movement.

GitLab strongly recommends that customers with self-managed server instances upgrade to a new version as soon as possible. The company also released two threat detection tools to help uncover exploitation attempts. GitLab-managed infrastructure, including GitLab.com and GitLab Dedicated, is reportedly patched.

'Stay alert for unusual activity'

Experts urged organizations to inventory and patch self-managed GitLab instances this week. As of midday on Oct. 22, there seemed to be no evidence of in-the-wild exploitation.

"A remotely reachable, unauthenticated vulnerability with a CVSS 10.0 rating presents an attractive target, particularly because self-managed GitLab servers are frequently exposed to the internet," the SOC Prime threat researchers wrote.

They also advised security teams to stay alert for unusual activity such as unexpected GitLab application crashes, bursts of rendering errors and unexpected shell execution. After upgrading, they said, review GitLab application logs and operating system telemetry for signs of compromise.

"Because GitLab installations often act as trusted infrastructure within software development pipelines, responders should also determine whether an attacker could have modified source code, artifacts, container images, infrastructure-as-code templates or deployment workflows," the researchers warned.

"A compromised GitLab server can create downstream supply chain risk even after the original server is remediated."

Galarza Mancedo also noted that GitLab users who patched on Oct. 12 against a previous critical-severity regular expression flaw (CVE-2026-97229) need to update again. Unlike this patch, that one stopped at version 19.2.

GitLab's patch release on Oct. 21 also included fixes for two high-severity, five medium-severity and four low-severity flaws. TechTarget has approached the company for comment. This article will be updated when we hear back.

Alissa Irei is an Informa TechTarget senior reporter covering cybersecurity news.

Dig Deeper on Threat Detection & Incident Response