GitLab CVE-2026-110264: patch the critical RCE safely

GitLab’s October 21, 2026 critical patch fixes CVE-2026-110264, a CVSS 10.0 flaw that can let an unauthenticated attacker execute code on a self-managed GitLab server through an integer overflow while compiling a crafted regular expression. If you run an affected GitLab CE or EE release, move immediately to a fixed patch in your supported branch: 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3 or 19.5.1. Inventory every web, Sidekiq, Gitaly and Geo node; preserve evidence; take a complete, restorable backup; follow required upgrade stops; then verify migrations and every replica.

GitLab has published two detections for exploitation attempts: “Onigmo native worker crash” and “Org mode render error burst.” A match is an investigation trigger, not proof of compromise. The affected ranges, fixed releases, severity and detection names below are vendor facts. The operational rollout, evidence and verification plan is engineering analysis.

The decision first

GitLab lists every CE and EE version from 7.0 before 18.11.13 as affected, plus the affected 19.x intervals shown above. The vendor says GitLab.com is patched and specified GitLab Dedicated internal releases already contain the fixes. This guide therefore focuses on self-managed instances.

What the critical flaw changes

CVE-2026-110264 is in the regular-expression compilation path. Under certain conditions, a specially crafted expression can cause an integer overflow and lead to arbitrary code execution on the GitLab server without authentication. That combination—network reachability, no account requirement and server-side code execution—explains the maximum CVSS score.

Do not turn the public description into a production exploit test. Version and deployment evidence are sufficient to determine patch need. Sending crafted inputs risks crashing or corrupting a service and does not prove the fleet is clean.

The same patch release also fixes two High-severity issues worth including in the change record:

• CVE-2026-15723 can allow an authenticated user to take over an LDAP-backed account when both OmniAuth SAML and LDAP auto-linking are enabled. It affects releases from 10.1 before 19.3.6, 19.4 before 19.4.3 and 19.5 before 19.5.1.
• CVE-2026-112212 can let an unauthenticated user poison a shared OAuth/OIDC discovery-document cache and redirect certain flows to an attacker-controlled server. It affects releases from 18.3 before 19.3.6, 19.4 before 19.4.3 and 19.5 before 19.5.1.

These two flaws are configuration and flow dependent. The RCE is the reason to patch every affected self-managed instance, not only deployments using SAML, LDAP or OIDC.

Attempt, vulnerability and compromise are different states

Use four evidence states in incident communication:

GitLab calls its two published rules detections for exploitation attempts. A native-worker crash can also have non-malicious causes; a render-error burst can be noisy. Conversely, silence does not prove no attempt occurred if the relevant logs were not retained. Correlate detections with request timestamps, application and system logs, process ancestry, new users or tokens, deploy keys, webhooks, runner registrations, CI/CD variables, repository changes, outbound connections and audit events.

If a signal matches, snapshot the instance and logs according to policy before restarting. Record the executing GitLab version and package or image digest. Rotate credentials based on actual exposure: instance secrets, runner tokens, deploy keys, personal and project access tokens, cloud credentials available to jobs, and integration secrets. Do not rotate blindly before preserving evidence if doing so would erase useful attribution.

Inventory the complete GitLab deployment

The web UI version on one node is not a fleet inventory. Record:

• package, source or Helm deployment type and exact version;
• every Rails web and Sidekiq node, Gitaly and Praefect service, Geo primary and secondary, runner manager and toolbox pod;
• PostgreSQL, Redis and object-storage topology;
• external authentication, including SAML, LDAP and OIDC settings;
• current image digests or package revisions, maintenance owner and recovery owner;
• pending background and database migrations;
• backup location, encryption key access and the last successful restore test.

For containers and Kubernetes, query image digests for running and suspended workloads. Mutable tags are not proof. For packages, pin the exact GitLab release during the emergency change so a repository default does not select an unintended branch.

Build a safe upgrade path

1. Select the fixed patch in the currently supported minor whenever that is the shortest safe move. Do not interpret the table as permission to skip required upgrade stops from an old release.
2. Use GitLab’s upgrade-path documentation. For GitLab 18, required stops include 18.2, 18.5, 18.8 and 18.11; for GitLab 19 they include 19.2 and 19.5 at this point in the release line. At each stop, wait for background migrations to finish.
3. Export a complete inventory and preserve security logs before the maintenance window.
4. Create a full backup and separately protect items the normal application archive does not include, such as object storage, configuration under /etc/gitlab, TLS and SSH keys, system files and external hooks.
5. Prove the restore runbook. GitLab requires restoration into the same application version as the backup; a database rollback onto an arbitrary older binary is not a safe rollback plan.
6. Pause new CI/CD work and enable the documented maintenance controls. Keep PostgreSQL, Redis and Gitaly available while applying a Linux package upgrade.
7. Apply the exact patch and allow database migrations to complete. GitLab notes that this patch contains database migrations; a single-node deployment has downtime because migrations finish before GitLab starts. Multi-node operators should use the documented zero-downtime procedure only when their architecture and current release support it.
8. Upgrade all nodes in the supported order, then runners and auxiliary images that must match the release.
9. Run health and functional checks before reopening writes.

An emergency patch is not the moment to combine an operating-system migration, database major upgrade and GitLab architecture redesign. Separate unrelated change risk unless a supported upgrade path makes a dependency change mandatory.

Backup and rollback are part of the patch

GitLab’s application backup can include the database and configuration, repositories, LFS objects, artifacts, job data, uploads, wikis, secure files, Pages, Terraform state and snippets. It does not automatically make every external dependency recoverable. External object storage, /etc/gitlab configuration, certificates and keys, hooks and system-level files need explicit coverage.

Store the backup outside the instance, verify checksums and access controls, and record the GitLab version that created it. A restore test should validate application startup, authentication, repository reads and writes, LFS, artifacts, registry access and representative pipelines. GitLab’s restore documentation also calls for a working installation of the same version as the backup; plan capacity accordingly rather than discovering the constraint during rollback.

Verify the fleet, not only the package transaction

After the upgrade, prove all of the following:

• every GitLab web and Sidekiq node reports the chosen fixed patch;
• Gitaly, Praefect, Geo and toolbox components are compatible and healthy;
• database and background migrations are complete, not merely scheduled;
• readiness endpoints and service dependencies are healthy;
• local login and each configured SSO path work with test accounts;
• clone, fetch, push, merge request and protected-branch enforcement work;
• one controlled CI pipeline can obtain artifacts, cache and registry access;
• webhooks, mail, package registry and object storage work;
• no old package, image digest, autoscaling template or rollback artifact can return an affected release.

Use protected operations telemetry to record version and digest across replicas; do not expose a detailed public version endpoint. Retain the pre- and post-change evidence with the incident or change ticket.

If patching cannot start immediately

GitLab’s advisory recommends upgrading affected installations as soon as possible and does not present a configuration-only workaround for the critical RCE. Temporary controls should therefore reduce exposure while the patch is prepared, not be called a fix:

• remove public reachability or restrict access to a tightly controlled network boundary;
• enable maintenance mode and pause risky integrations or writes where operationally feasible;
• increase retention and alerting for the two GitLab detections and correlated process anomalies;
• prevent new runner or token creation outside approved administration;
• prepare a trusted replacement instance if integrity is already in doubt.

A WAF rule, authentication requirement or disabled SAML feature does not remove the vulnerable regular-expression compiler path. Reopen normal access only after the fixed fleet and migration state are verified.

Best practices

• Treat GitLab as a production control plane because it holds source, CI credentials and deployment authority.
• Keep a node-level version and immutable digest inventory.
• Test backup restoration on every supported release train.
• Separate vulnerability, attempt and compromise language in status reports.
• Subscribe to GitLab critical patch notices and pre-approve emergency windows.
• Preserve enough application, audit, process and network telemetry for retrospective review.

Anti-patterns

• Checking one UI footer and assuming every node is fixed.
• Jumping major releases without required stops or completed migrations.
• Calling a detection hit confirmed compromise—or calling silence proof of safety.
• Taking only the automatic package backup and ignoring external object storage and /etc/gitlab.
• Reusing a mutable container tag while old pods or autoscaling templates remain.
• Downgrading the database instead of restoring a version-matched, tested backup.
• Running public exploit code against production as a “verification” step.

Executive takeaway

CVE-2026-110264 is an unauthenticated server-side RCE in a platform that often controls source code, build secrets and deployment paths. Patch every affected self-managed GitLab instance to the fixed release in its supported branch, following required upgrade stops and migration guidance. Preserve evidence and investigate GitLab’s two attempt detections without overstating them. The change is complete only when every node, migration, authentication path and recovery artifact is verified.

Continue with the Cloud, DevOps & Kubernetes hub, NGINX October 2026 security patch guide, Node.js October 2026 security release guide and Apache Tomcat October 2026 patch guide.

Primary references

• GitLab — Critical Patch Release 19.5.1 and backports
• GitLab — Plan your upgrade path
• GitLab — Upgrade Linux package instances
• GitLab — Back up GitLab
• GitLab — Restore GitLab
• Wikimedia Commons — Code Review photo-1
• Creative Commons Attribution-ShareAlike 3.0

Prepared by: Noor Yasser

Prepared by: Noor Yasser