/
← Voltar ao feed
critical

GitLab patches CVE-2026-110264, a CVSS 10.0 unauthenticated RCE in the CE/EE regex compiler affecting every release since 7.0

5 fonte(s) · 5 atualização(ões) · publicado 20/10/2026 21:00 · coletado há 17 horas

Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 5 fontes trouxeram em 23/10/2026 00:07; os links antigos trazem para cá.

Fontes: theregister.com ↗ bleepingcomputer.com ↗ gbhackers.com ↗ thehackernews.com ↗ docs.gitlab.com ↗

GitLab released critical patch versions on October 21, 2026 for CVE-2026-110264, a CVSS 10.0 integer overflow in the regular expression compiler of GitLab CE/EE. A specially crafted expression could let an unauthenticated attacker run arbitrary code on a self-managed server (docs.gitlab.com). Affected releases go back to version 7.0 (June 2014). Fixes ship in 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13. GitLab reports no in-the-wild exploitation, and the flaw was not in the CISA KEV catalog as of October 22 (thehackernews.com). The Register expects scanning for vulnerable instances to start soon (theregister.com). Shadowserver tracks over 2,700 internet-exposed GitLab CE instances, without saying how many are honeypots or already patched (bleepingcomputer.com). Administrators who patched CVE-2026-97229 on October 12 must upgrade again, because that fix covered only 19.2 and later (thehackernews.com). The researcher reported the flaw through HackerOne.

Entenda a falha

A vulnerabilidade

CVE-2026-110264 (CVSS 10.0, AV:N/AC:L/PR:N/UI:N) is an integer overflow in the regular expression compiler of GitLab CE/EE. Under conditions GitLab has not disclosed, an unauthenticated remote attacker could run arbitrary code on a self-managed server. Every version from 7.0 is affected; fixes are 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13, and no workaround exists. GitLab.com is already patched. The release also fixes CVE-2026-15723 (8.2, SAML/LDAP account takeover by an authenticated user when auto-linking is on) and CVE-2026-112212 (7.5, OAuth/OIDC discovery cache poisoning), plus lower-severity access-control and information-leak flaws (CVE-2026-12664, 16255, 105777, 13319, 112378, 105711, 14288, 112326, 103515).

Como funciona

GitLab uses a regular expression engine to parse and validate expressions. The Hacker News says this is Ruby's Onigmo engine, which GitLab bundles in its own packages. When a specially crafted expression reaches the compiler, a size or count calculation overflows during compilation, and GitLab says this can end in code execution on the server. GitLab has not said how an unauthenticated attacker gets an expression to the compiler, so no one can rule themselves out by configuration. The two detections it published, 'Onigmo native worker crash' and 'Org mode render error burst', indicate which log signals to hunt for.

Por que é vulnerável

The root cause is an integer overflow when the regex engine compiles a crafted pattern, so a numeric value exceeds what the compiler expects. According to The Hacker News, the weakness is in Onigmo itself, which GitLab ships and patches in its own builds, so it exists in every release since 7.0. That explains the age of the affected range. The release also adds patches for a Ruby regexp repeat ID overflow and a double-free for Ruby 3.3, 3.4 and 4.0. The articles do not detail what the fix changes in the compiler.

Onde está

No file, function or commit is named; the articles only point to the Onigmo regular expression engine that GitLab bundles and patches in its own packages.

Como foi descoberta

The flaw was reported through GitLab's HackerOne bug bounty program. GitLab, The Hacker News, GBHackers and BleepingComputer credit the handle joaxcar, while The Register names Johan Carlsson; the articles do not say whether they are the same person. The Hacker News says the same researcher reported the earlier regex-engine flaws CVE-2026-97229 (October 12), CVE-2026-93577 and CVE-2026-89078 (September 23). GitLab disclosed it in the October 21 patch release and says issue details become public 90 days later. It reports no exploitation, and the flaw was not in the CISA KEV catalog as of October 22.

Explicação gerada por IA a partir da matéria e dos artigos, em 23/10/2026 00:23.

Detalhes técnicos

  • CVE-2026-110264 (CVSS 10.0, AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H): integer overflow when compiling a crafted regular expression, leading to RCE (docs.gitlab.com, gbhackers.com).
  • Root cause: the Onigmo regex engine, which GitLab bundles and patches in its own packages (thehackernews.com). The release also adds Ruby regexp repeat ID overflow and double-free patches for Ruby 3.3, 3.4 and 4.0 (docs.gitlab.com).
  • GitLab has not stated the preconditions an attacker needs to reach the compiler, so administrators cannot rule themselves out by configuration (thehackernews.com). The Register says only that exploitation works "under certain conditions".
  • The fix is backported to 18.11.13, 19.0.10, 19.1.9 and 19.2.9, beyond the normal policy of the current and previous two releases (thehackernews.com).
  • Related earlier flaws, all reported by the same researcher (thehackernews.com):
    • CVE-2026-97229 (CVSS 10.0, unauthenticated), fixed October 12 in 19.2.8, 19.3.5 and 19.4.2.
    • CVE-2026-93577 and CVE-2026-89078 (both CVSS 9.9, authenticated), fixed September 23.
    • CVE-2026-110264 is the first of these to reach versions before 19.2.
  • GitLab published two detections for self-managed instances, "Onigmo native worker crash" and "Org mode render error burst" (Sigma rules in its TLDR framework per thehackernews.com). They support investigating attempts and are not confirmation of an active campaign (gbhackers.com).
  • SOC Prime warns that a compromise could expose source code, CI/CD configuration, deployment secrets, access tokens and infrastructure definitions. That would enable credential theft, repository manipulation, supply chain attacks, persistence and lateral movement (theregister.com).
  • Other fixes in the same release (docs.gitlab.com):
    • CVE-2026-15723 (CVSS 8.2, affects 10.1 onward): an authenticated user can take over an existing LDAP-backed account when OmniAuth SAML and LDAP auto-linking are both enabled, with no victim interaction. gbhackers.com attributes the cause to improper input sanitization in the LDAP email lookup used for identity linking.
    • CVE-2026-112212 (CVSS 7.5, affects 18.3 onward): an unauthenticated user can poison the shared OAuth/OIDC discovery cache and redirect flows to an attacker-controlled server.
    • CVE-2026-12664 (CVSS 6.8): a GraphQL field leaks the project incoming email address, letting a read_api token create work items.
    • CVE-2026-16255 (CVSS 5.9, EE): incomplete enforcement of the SAML/LDAP membership lock.
    • CVE-2026-105777 (CVSS 4.3): internal credentials exposed through response headers.
    • CVE-2026-13319 (CVSS 4.3): private project milestone metadata readable through the group milestones API.
    • CVE-2026-112378 (CVSS 4.3, EE): paid AI features reachable without a valid subscription.
    • CVE-2026-105711 (CVSS 3.5): confidential issue titles leak through a fragment cache.
    • CVE-2026-14288 (CVSS 3.1, EE): merge request approval policy bypass.
    • CVE-2026-112326 (CVSS 3.1, EE): a read-only user can delete vulnerability records.
    • CVE-2026-103515 (CVSS 2.7, EE): a group Owner can bypass the Duo admin lock for Amazon Q settings.
  • Context: this is the third critical GitLab flaw in about a month, after CVE-2026-97229 and CVE-2026-85706 (unauthenticated data read, added to the CISA exploited list one day after its fix). CISA has flagged five GitLab flaws as exploited since November 2021, including one used in ransomware (bleepingcomputer.com).

Remediação

  • Upgrade self-managed CE/EE immediately to the fixed release for the installed branch: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 or 18.11.13. This applies even to instances already patched on October 12 (thehackernews.com).
  • GitLab offers no interim workaround (thehackernews.com).
  • GitLab.com is already patched. GitLab Dedicated tenants on 19.3.5-internal0 and 19.4.2-internal0 or later need no action.
  • Deploy the two GitLab detections and hunt for attempts.
  • Plan for downtime on single-node instances, because the release includes database migrations (19.3.6 and 19.4.3 per thehackernews.com; 19.4.3 also has post-deployment migrations per gbhackers.com). Multi-node setups can use zero-downtime procedures.
  • Vulnerability details become public 90 days after the fixing release (gbhackers.com).

Relatos divergentes

  • Total fixed vulnerabilities: thehackernews.com says 11 in total. docs.gitlab.com (the vendor, most authoritative) says eleven others besides CVE-2026-110264, and gbhackers.com says twelve in total. docs.gitlab.com lists 12 CVEs, which supports 12.
  • Researcher: thehackernews.com, gbhackers.com and bleepingcomputer.com name joaxcar. theregister.com names Johan Carlsson. The sources do not explicitly say these are the same person.
  • Version ranges: bleepingcomputer.com lists only fixed versions. docs.gitlab.com, thehackernews.com, gbhackers.com and theregister.com state that all versions from 7.0 onward are affected.
  • Prior exploitation: theregister.com says another max-severity CE/EE flaw was attacked days after its patch last month, per CISA and private researchers, without naming it. bleepingcomputer.com says CVE-2026-85706 was added to the CISA exploited list one day after its fix. No source reports exploitation of CVE-2026-110264 itself.
  • Framing of the series: bleepingcomputer.com calls this the third critical flaw in a month. thehackernews.com calls it the fourth regex-engine code-execution flaw from the same researcher in a month.
  • CVE-2026-15723 cause: docs.gitlab.com describes improper authentication. gbhackers.com cites improper input sanitization in the LDAP email lookup. The two are not necessarily incompatible.

Linha do tempo

  1. theregister.com ↗ · pub. 22/10/2026 14:36 · coletado 22/10 15:00

    GitLab patches max-severity unauthenticated RCE (CVE-2026-110264) affecting CE/EE releases back to 7.0

    The Register adds that affected versions go back to GitLab 7.0 (June 2014), that the researcher is named as Johan Carlsson, and that GitLab released two threat detections for self-managed customers. It also cites SOC Prime's impact assessment and states there is no indication of in-the-wild exploitation yet.

    ler a análise desta fonte

    The Register adds that affected versions go back to GitLab 7.0 (June 2014), that the researcher is named as Johan Carlsson, and that GitLab released two threat detections for self-managed customers. It also cites SOC Prime's impact assessment and states there is no indication of in-the-wild exploitation yet.

    GitLab patched CVE-2026-110264, a CVSS 10 integer overflow in regular-expression compilation that, under certain conditions, lets unauthenticated attackers execute arbitrary code on self-managed GitLab Community Edition (CE) and Enterprise Edition (EE) servers. Affected releases reach back 12 years to GitLab 7.0 (June 2014). The vendor "strongly recommends" upgrading as soon as possible. No in-the-wild exploitation has been reported yet, but the report expects scanning for vulnerable instances to start soon. The bug was reported by Johan Carlsson via HackerOne.

    Technical Details

    • Integer overflow when compiling a specially crafted regular expression; exploitation requires no authentication, under certain conditions.
    • Affects GitLab CE and EE from 7.0 onward.
    • SOC Prime warns that server compromise could expose source code, CI/CD configuration, deployment secrets, access tokens and infrastructure definitions. This enables credential theft, repository manipulation, supply chain attacks, persistence and lateral movement.
    • Last month another max-severity flaw in GitLab CE/EE was attacked days after its patch, according to CISA and private researchers.

    Remediation

    • Upgrade to 19.5.1, 19.4.3 or 19.3.6, or to the backported releases 19.2.9, 19.1.9, 19.0.10 or 18.11.13.
    • GitLab.com and GitLab Dedicated are already patched.
    • GitLab released two threat detections for customers with self-managed instances.
  2. bleepingcomputer.com ↗ · pub. 22/10/2026 08:41 · coletado 22/10 09:00

    GitLab patches max-severity unauthenticated RCE (CVE-2026-110264) in Regular Expression Compiler

    ler a análise desta fonte

    GitLab released security patches for CVE-2026-110264, a maximum-severity integer overflow flaw in its Regular Expression Compiler that can let an unauthenticated remote attacker execute arbitrary code on vulnerable servers. The researcher joaxcar reported it through GitLab's HackerOne bug bounty program. Shadowserver currently tracks over 2,700 internet-exposed GitLab Community Edition instances, though it does not say how many are honeypots or already patched. The article does not report exploitation in the wild. This is the third critical GitLab flaw in about a month, following CVE-2026-97229 (CI/CD Regular Expression Compiler RCE, CVSS 10/10, reported by the same researcher ten days earlier) and CVE-2026-85706 (unauthenticated data read, added to CISA's actively exploited list one day after its fix).

    Technical Details

    • The flaw is an integer overflow triggered when compiling a specially crafted regular expression, which can allow unauthenticated code execution on the GitLab server.
    • The Regular Expression Compiler is a background engine that parses and validates regular expressions in configuration files.
    • Affected products are GitLab CE and EE. The article does not list the vulnerable version ranges, only the fixed versions.
    • Since November 2021, CISA has flagged five GitLab flaws exploited in the wild, including one used in ransomware attacks.

    Remediation

    • Upgrade GitLab CE/EE to 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 or 18.11.13 immediately.
    • GitLab.com already runs the patched version.
    • GitLab Dedicated tenants on 19.3.5-internal0 and 19.4.2-internal0 or later already include the fixes and need no action.
  3. gbhackers.com ↗ · pub. 22/10/2026 01:53 · coletado 22/10 02:00

    GitLab patches CVE-2026-110264, a CVSS 10.0 unauthenticated RCE in CE/EE affecting versions since 7.0

    The article largely restates the known report, with a few added details: 19.4.3 also carries post-deployment migrations, CVE-2026-15723 stems from improper input sanitization in the LDAP email lookup, and the RCE fix is backported to four older branches. It also notes that the advisory's detection guidance should not be read as confirmation of exploitation.

    ler a análise desta fonte

    The article largely restates the known report, with a few added details: 19.4.3 also carries post-deployment migrations, CVE-2026-15723 stems from improper input sanitization in the LDAP email lookup, and the RCE fix is backported to four older branches. It also notes that the advisory's detection guidance should not be read as confirmation of exploitation.

    GitLab released emergency security updates on October 21, 2026 for CVE-2026-110264, a CVSS 10.0 remote code execution flaw in GitLab Community Edition and Enterprise Edition that unauthenticated attackers could use to run arbitrary code on the server. The bug is an integer overflow in the regular expression compiler triggered by a specially crafted expression. Affected releases go back to version 7.0, and fixes ship in 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3 and 19.5.1. Researcher joaxcar reported it through HackerOne. GitLab's advisory does not indicate in-the-wild exploitation. The release fixes twelve vulnerabilities in total, including two high-severity ones.

    Technical Details

    • CVE-2026-110264: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. The RCE fix is backported to four older branches beyond the standard patch releases.
    • GitLab published two detections for self-managed customers, "Onigmo native worker crash" and "Org mode render error burst". They support investigation of exploitation attempts and are not confirmation of an active campaign.
    • CVE-2026-15723 (CVSS 8.2): an authenticated attacker can take over an existing LDAP-backed account when OmniAuth SAML and LDAP auto-linking are both enabled. The cause is improper input sanitization in the LDAP email lookup used for identity linking, and the victim does not need to interact.
    • CVE-2026-112212 (CVSS 7.5): cache poisoning in OAuth/OIDC discovery endpoints lets an unauthenticated attacker alter a shared discovery document and redirect flows to an attacker-controlled server.
    • Other fixes cover GraphQL token restrictions, identity-provider membership locks, internal credential exposure, private milestone metadata disclosure, AI subscription checks, confidential issue titles, approval policies, vulnerability records and administrative AI controls.
    • Versions 19.3.6 and 19.4.3 include regular database migrations, and 19.4.3 also includes post-deployment migrations.

    Remediation

    • Upgrade self-managed instances immediately to the fixed release for the installed branch.
    • GitLab.com is already patched. GitLab Dedicated tenants on 19.3.5-internal0 and 19.4.2-internal0 or later need no action.
    • Single-node upgrades require downtime for migrations. Multi-node environments can avoid it with zero-downtime procedures.
    • Vulnerability details become public 90 days after the fixing release.
  4. thehackernews.com ↗ · pub. 21/10/2026 15:57 · coletado 21/10 17:00

    GitLab fixes CVE-2026-110264, a CVSS 10.0 unauthenticated RCE in the regex compiler affecting every release since 7.0

    The article adds that the October 12 patch (CVE-2026-97229) covered only 19.2 and later, so instances patched then must upgrade again. It also adds the Onigmo root cause, the link to the three earlier regex flaws reported by joaxcar, GitLab's statement that it sees no exploitation, the absence from CISA KEV as of October 22, and the lack of any workaround or stated attack preconditions.

    ler a análise desta fonte

    The article adds that the October 12 patch (CVE-2026-97229) covered only 19.2 and later, so instances patched then must upgrade again. It also adds the Onigmo root cause, the link to the three earlier regex flaws reported by joaxcar, GitLab's statement that it sees no exploitation, the absence from CISA KEV as of October 22, and the lack of any workaround or stated attack preconditions.

    GitLab released fixes on October 21 for CVE-2026-110264, a CVSS 10.0 flaw that could let an unauthenticated attacker run arbitrary code on a self-managed server. It affects every version back to 7.0 (2014). The flaw is an integer overflow in the compilation of a specially crafted regular expression, in the Onigmo engine that GitLab bundles. Administrators who patched on October 12 are in range again, because that update covered only versions 19.2 and later. GitLab reports no sign of exploitation, and the flaw was not in the CISA KEV catalog as of October 22.

    Technical Details

    • Root cause: an integer overflow in Onigmo, Ruby's built-in regex engine, which GitLab ships and patches in its own packages. Every release since 7.0 is affected.
    • GitLab has not said what conditions or preconditions an attacker needs to reach the compiler, so administrators cannot rule themselves out by configuration.
    • It is the fourth regex-engine code-execution flaw reported by researcher joaxcar in a month, and the first to reach versions before 19.2. The earlier ones are CVE-2026-97229 (CVSS 10.0, unauthenticated, fixed October 12 in 19.2.8, 19.3.5 and 19.4.2) and CVE-2026-93577 and CVE-2026-89078 (both CVSS 9.9, authenticated, fixed September 23).
    • The fix was backported to 18.11.13, 19.0.10, 19.1.9 and 19.2.9, beyond the normal policy of the current and previous two releases.
    • The release fixes 11 security issues in total, including CVE-2026-15723 (CVSS 8.2, account takeover with SAML and LDAP auto-linking) and CVE-2026-112212 (CVSS 7.5, OAuth/OIDC cache poisoning).
    • GitLab published two Sigma detections in its TLDR framework, "Onigmo native worker crash" and "Org mode render error burst".

    Remediation

    • Upgrade self-managed instances to the fixed version for the installed branch, even if already patched on October 12. GitLab.com and GitLab Dedicated 19.3.5-internal0 and 19.4.2-internal0 or later already have the fix.
    • GitLab offers no interim workaround.
    • Deploy the two detection rules to look for exploitation attempts.
    • Plan for downtime on single-node servers, because 19.4.3 and 19.3.6 run database migrations. Multi-node setups can use the zero-downtime procedure.
  5. docs.gitlab.com ↗ · pub. 20/10/2026 21:00 · coletado 21/10 16:01 primeiro registro

    GitLab patches CVE-2026-110264, a CVSS 10.0 unauthenticated RCE in CE/EE, in critical patch release 19.5.1

    ler a análise desta fonte

    GitLab released critical patch versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13 for GitLab CE/EE on October 21, 2026. The release fixes CVE-2026-110264, an integer overflow in the regular expression compiler that could allow an unauthenticated user to execute arbitrary code on the GitLab server (CVSS 10.0). It affects all versions from 7.0 onward before the fixed releases. Eleven other vulnerabilities are fixed, including an account takeover via OmniAuth SAML and LDAP auto-linking (CVE-2026-15723, CVSS 8.2) and OAuth/OIDC discovery cache poisoning (CVE-2026-112212, CVSS 7.5). The article does not report in-the-wild exploitation. GitLab urges all self-managed installations to upgrade immediately. GitLab.com is already patched, and GitLab Dedicated tenants on 19.3.5-internal0 and 19.4.2-internal0 or later need no action.

    Technical Details

    • CVE-2026-110264 (CVSS 10.0, AV:N/AC:L/PR:N/UI:N/S:C): integer overflow when compiling a specially crafted regular expression, leading to RCE. The fix is backported to 18.11.13, 19.0.10, 19.1.9 and 19.2.9. The release also adds Ruby regexp repeat ID overflow and double-free patches for Ruby 3.3, 3.4 and 4.0. GitLab published two detections for self-managed instances: "Onigmo native worker crash" and "Org mode render error burst".
    • CVE-2026-15723 (CVSS 8.2): improper authentication. When OmniAuth SAML and LDAP auto-linking are both enabled, an authenticated user can take over an existing LDAP-backed account with no interaction from the victim. Affects 10.1 onward.
    • CVE-2026-112212 (CVSS 7.5): an unauthenticated user can poison a shared cache of the OAuth/OIDC discovery document and redirect flows to an attacker-controlled server. Affects 18.3 onward.
    • CVE-2026-12664 (CVSS 6.8): a GraphQL field leaks the project incoming email address, allowing a read_api token to create work items. Affects 18.2 onward.
    • CVE-2026-16255 (CVSS 5.9, EE): the SAML/LDAP membership lock is incompletely enforced for requests created before the lock was enabled.
    • CVE-2026-105777 (CVSS 4.3): internal server credentials exposed through internal response headers.
    • CVE-2026-13319 (CVSS 4.3): the group milestones API lets a user read milestone metadata from arbitrary private projects.
    • CVE-2026-112378 (CVSS 4.3, EE): paid AI features can be accessed without a valid subscription.
    • CVE-2026-105711 (CVSS 3.5): a fragment cache leaks the titles of confidential issues.
    • CVE-2026-14288 (CVSS 3.1, EE): merge request approval policy bypass.
    • CVE-2026-112326 (CVSS 3.1, EE): a read-only user can delete vulnerability records.
    • CVE-2026-103515 (CVSS 2.7, EE): a group Owner can bypass the Duo admin lock for Amazon Q settings.
    • The patch includes database migrations. Single-node instances will have downtime, while multi-node instances can upgrade without downtime using zero-downtime procedures.

    Remediation

    • Upgrade all self-managed GitLab instances immediately to 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 or 18.11.13, whichever matches the installed branch.
    • Deploy the two GitLab threat detections for CVE-2026-110264 on self-managed instances.
    • Plan for downtime on single-node instances because of the migrations.
    • Issue details are made public on the GitLab tracker 90 days after the patch release.