GitLab has released emergency security patches for a flaw rated the maximum possible severity score, a bug that could let an attacker run code on a self-managed server without ever logging in.
Tracked as CVE-2026-110264, the flaw carries the maximum CVSS score of 10.0 and affects both GitLab Community Edition and Enterprise Edition. The company published the fixes on October 21, 2026 , and said it affects versions of the software going back to GitLab 7.0, released in 2014.
What the flaw does
CVE-2026-110264 is a critical flaw in the regular expression engine inside GitLab, where a specially crafted regular expression causes an integer overflow when it is compiled.
GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression. GitLab rates the flaw 10.0, the highest possible score on the Common Vulnerability Scoring System.
According to independent technical analysis of the bug, rendering a crafted .org file lets an attacker with no login run commands on the GitLab server.
That means the vulnerability does not require stolen credentials or an authenticated session, the kind of entry point that typically limits how many systems a single flaw can expose.
GitLab’s own advisory, corroborated by The Hacker News, states that the issue under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression.
Which versions are affected
On 21 October 2026 GitLab fixed CVE-2026-110264, a critical flaw that can let an attacker run code on a self-managed GitLab server without logging in. It reaches back to GitLab 7.0, and servers patched on 12 October are still affected , since that earlier fix addressed a separate CVE.
GitLab offers no workaround: upgrade to the fixed release for your version.
The patch covers seven separate release lines at once. On October 21, 2026, GitLab shipped a critical patch release, an out-of-band fix outside the regular release schedule , covering versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13.
Anything older than that range has reached end of support and has no fixed build available, according to GitLab’s advisory.
The release covers more than the headline flaw. It contains 12 security fixes. On GitLab’s four-level severity scale (Critical, High, Medium, Low), one is Critical (CVE-2026-110264) and two are High.
Among the other issues patched, GitLab’s advisory lists an “Improper Authentication issue in OmniAuth-to-LDAP auto-linking email lookup impacts GitLab CE/EE,” rated High severity.
A pattern of regex bugs
This is not an isolated incident. Security researchers tracking GitLab’s recent advisories found that the same bug class has surfaced repeatedly in recent weeks.
This is the fourth code-execution flaw in GitLab’s regular-expression engine that the same researcher, who uses the handle joaxcar, has reported in a month, with three prior reports on October 12 and September 23.
One earlier bug in that string, patched October 12 and tracked as CVE-2026-97229, also carried a maximum CVSS score, according to Rapid7’s technical analysis of that flaw.
On GitLab’s four-level severity scale of Critical, High, Medium and Low, one of the twelve fixes in the October 21 release is Critical and two are High.
Taken together, the cluster of advisories points to a systemic weakness in how the platform parses user-supplied regular expressions rather than a single isolated coding mistake.
Why it matters for businesses
GitLab is widely used by software teams, similar to the kind of enterprise infrastructure discussed in GCN’s recent coverage of the Git code merge surge at AI labs, underscoring how central these platforms have become to daily engineering workflows.
A pre-authentication remote code execution bug in such a widely deployed tool is considered especially dangerous because it does not require a stolen password or insider access, only network reach to a vulnerable server.
As of the most recent check by security researchers, the CVE is absent from CISA’s known-exploited catalog as of October 22 . No public proof-of-concept exploit code has surfaced either, according to the same review.
GitLab-managed infrastructure, including GitLab.com and GitLab Dedicated are already patched , leaving the exposure concentrated among organizations that run their own self-managed GitLab servers, particularly those exposed directly to the internet.
Administrators managing cloud infrastructure, a topic GCN has also tracked in coverage of data center networking, are being urged to prioritize patching internet-facing instances first.
