By ByteBot
GitLab shipped an emergency patch on October 21 for CVE-2026-110264, a CVSS 10.0 unauthenticated remote code execution flaw that reaches every self-managed Community and Enterprise Edition instance going back to version 7.0 — released in 2014. No login required. No user interaction. No elevated account. If your team runs GitLab on its own infrastructure and has not upgraded in the last 24 hours, your code host is currently exploitable from the network.
What the Flaw Does
The vulnerability lives inside Onigmo, the regex engine Ruby ships with, surfaced through the org-ruby gem that GitLab uses to render Org-mode files. When GitLab previews a .org file, org-ruby takes the content of #+TODO: keywords and passes them directly into Regexp.new. Onigmo stores repeat counts in a signed 16-bit integer, which caps out at 32,767. Supply a keyword with more than 32,767 generic repeats and the counter wraps to a negative value — an out-of-bounds write at match time that an attacker can turn into arbitrary code execution on the server.
The CVSS vector is AV:N/AC:L/PR:N/UI:N/S:C — network accessible, low complexity, no privileges, no user interaction, changed scope. That last part means exploitation does not just compromise GitLab; it can reach anything the server process can touch. Confidentiality, Integrity, and Availability are all rated High. This is as bad as a vulnerability gets on paper, and the technical reality backs the score.
Who Is Actually at Risk
GitLab.com and GitLab Dedicated are already patched — if your organization uses the hosted service, you have nothing to do here. Self-managed installations are the entire risk surface: Community Edition and Enterprise Edition alike.
Org-mode files can be rendered in public project file views, wikis, and README files. An attacker needs no GitLab account to trigger rendering on a public project. On instances with open registration or any publicly visible content, the attack surface is effectively the open internet.
The October 12 Patch Trap
Here is where teams get burned. GitLab issued a prior security patch on October 12, 2026. That release covered only versions 19.2 and later. If your instance runs 19.0.x, 19.1.x, or 18.11.x and you patched on October 12, you are still vulnerable — that patch was never extended to your branch. And if you are on 19.2+ and applied the October 12 update, you still need October 21’s release: the fix sits one version number above where you currently are.
“We patched last week” is not a safe answer for this CVE.
Fixed Versions
GitLab released critical patches for seven maintained branches simultaneously on October 21:
| Branch | Fixed Version |
|---|---|
| 19.5 | 19.5.1 |
| 19.4 | 19.4.3 |
| 19.3 | 19.3.6 |
| 19.2 | 19.2.9 |
| 19.1 | 19.1.9 |
| 19.0 | 19.0.10 |
| 18.11 | 18.11.13 |
Anything older than 18.11 is beyond GitLab’s supported range. If you are running GitLab 18.10 or earlier, the table above does not help you — upgrade to a supported branch first.
How to Upgrade
For Omnibus (Linux package) installations:
# Debian / Ubuntu
sudo apt-get update && sudo apt-get install gitlab-ee
# RHEL / CentOS / Rocky
sudo yum update gitlab-eeReplace gitlab-ee with gitlab-ce for the Community Edition. Single-node instances will experience brief downtime while database migrations run. Multi-node deployments can use GitLab’s zero-downtime upgrade procedure.
For Helm / Kubernetes deployments:
helm repo update
helm upgrade gitlab gitlab/gitlab --reuse-values --set global.gitlabVersion=19.5.1Adjust the version string to match your branch’s fixed release from the table above.
How to Detect Exploitation Attempts
GitLab has not confirmed active exploitation as of this writing, and the CVE is not yet listed in CISA’s Known Exploited Vulnerabilities catalog. That will not last — CVSS 10.0 public vulnerabilities typically attract exploitation attempts within days of disclosure. While you still have lead time, monitor for:
- Onigmo native worker crashes in
/var/log/gitlab/ - Org-mode render error spikes — a burst of failed renders against the same project
- Unusual access patterns on
.orgfile endpoints, especially with large file sizes
If you find evidence of pre-patch exploitation, treat the server as fully compromised and rotate all stored credentials, tokens, and SSH keys immediately.
Patch Now
GitLab has 12 years of releases in the blast radius of this CVE. That does not make exploitation harder — it makes the population of exposed servers very large. The clock starts when an exploit proof-of-concept appears publicly. Do not schedule this for your next maintenance window. Patch it today.
