By A .org file in any public GitLab repository can root your server without a login. That is CVE-2026-110264 — a CVSS 10.0 remote code execution vulnerability hitting every self-managed GitLab CE and EE release since version 7.0, which shipped in 2014. GitLab released patches on October 21, 2026. If you run self-hosted GitLab and have not upgraded, you are exposed right now.
What Happened
GitLab disclosed CVE-2026-110264 on October 21 alongside a batch of fixed releases covering every active branch. The flaw scores a perfect 10.0 on the CVSS scale — the maximum possible — because it requires no authentication, no user interaction, and delivers arbitrary code execution on the target server. The execution context is the git service account, which holds the keys to your repository data, CI/CD secrets, database credentials, and API tokens.
GitLab.com cloud users are unaffected. GitLab patched its own infrastructure before the CVE went public. GitLab Dedicated tenants are also clear. The exposure is entirely on self-managed installations, and there are thousands of them.
How It Works
The attack chain runs through four components, and it starts with a feature most GitLab admins have never thought about: Org-mode file rendering.
GitLab renders .org files — the format used by Emacs Org-mode — using an open-source gem called org-ruby. When org-ruby parses an Org file, it reads the #+TODO: directive and constructs a Ruby regular expression from the keyword value. The problem: it passes that keyword directly to Regexp.new() without escaping it. Repository-controlled content goes straight into a regex compiler.
The regex compiler is Onigmo — Ruby’s bundled engine. Onigmo counts repeat operations using a normal integer but stores each repeat ID as a signed 16-bit value, with a maximum of 32,767. A keyword with more than 32,767 repetitions overflows that counter, wraps to negative, and the engine writes to memory well outside its intended region. The result is heap corruption that can be turned into code execution.
The trigger payload is 557,073 bytes of plain ASCII. No authentication headers. No exploit kit. A crafted .org file in any public project, and an attacker just needs GitLab to render it. Detailed technical analysis confirms crash-level proof-of-concept code already exists publicly.
Who Is Affected
Every self-managed GitLab CE/EE version from 7.0 through any release prior to the October 21 patches is vulnerable. That is twelve years of releases. The fixed versions by branch are:
| Current Branch | Upgrade To |
|---|---|
| 18.11.x | 18.11.13 |
| 19.0.x | 19.0.10 |
| 19.1.x | 19.1.9 |
| 19.2.x | 19.2.9 |
| 19.3.x | 19.3.6 |
| 19.4.x | 19.4.3 |
| 19.5.x | 19.5.1 |
If you are running a version older than 18.11.x, upgrade to the latest stable release in your nearest supported branch before anything else.
How to Patch
GitLab provides no interim workaround. There is no configuration option that disables Org-mode rendering. The only fix is an upgrade.
For Omnibus installations on Debian or Ubuntu:
sudo apt-get update && sudo apt-get install gitlab-ee=19.5.1-ee.0
sudo gitlab-ctl reconfigureFor Community Edition, replace gitlab-ee with gitlab-ce. RHEL-family systems use dnf install gitlab-ee-19.5.1-ee.0.el9. Docker deployments should update the image tag and recreate the container. Helm users should bump the chart version.
After upgrading, confirm the service is healthy with sudo gitlab-ctl status and check that background migrations have completed under Admin > Monitoring > Background Migrations before calling it done.
If upgrading tonight is not feasible, a partial mitigation is making your public repositories private. This does not fix the bug, but it removes the unauthenticated attack path. It is a stopgap, not a solution.
GitLab Has a Document Renderer Problem
This is the third maximum-severity regex-related RCE GitLab has patched in six weeks. CVE-2026-97229 hit on October 12 through CI/CD configuration rendering. CVE-2026-93577 arrived in September through the same surface with authentication required. Now CVE-2026-110264 arrives via a format most people do not even know GitLab supports.
The pattern is consistent: GitLab trusts repository-controlled input in rendering pipelines that invoke parsers and compilers. Org-mode, Jupyter notebooks, CI/CD configs — each one is a document format that turns into code at render time. Fixing individual CVEs closes specific paths; the architectural pattern that keeps producing them is worth examining.
For anyone running self-managed GitLab, the practical question is whether the operational cost of tracking and applying these patches — especially CVSS 10.0 patches with no workarounds — is built into your security posture. GitLab.com users got this fix before the CVE number existed. Self-hosted users are still racing to apply it a week later.
Patch tonight. Not this sprint, not next change window — tonight.
