GitLab released a critical patch update on October 21, 2026, fixing 12 security vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE).
The release includes a critical remote code execution vulnerability, along with issues affecting authentication, OAuth/OIDC, API access controls, confidential information, merge request approvals and vulnerability records.
The most serious issue is CVE-2026-110264, which carries a CVSS score of 10.0. GitLab recommends that all affected self-managed installations upgrade to the applicable patched version.
Critical vulnerability: CVE-2026-110264
Severity: Critical | CVSS 10.0
GitLab fixed an integer overflow vulnerability in its regular expression compiler. Under certain conditions, a specially crafted regular expression could trigger the issue and allow an unauthenticated user to execute arbitrary code on the GitLab server.
The vulnerability affects GitLab CE and EE versions starting from 7.0, with the affected ranges and fixes differing by release branch.
GitLab also published two threat detection rules to help self-managed customers identify potential exploitation attempts:
- Onigmo native worker crash
- Org mode render error burst
These detections are intended to support security monitoring and investigation.
Other vulnerabilities addressed
The same release fixes 11 additional vulnerabilities.
CVE-2026-15723 — CVSS 8.2 (High)
An authentication flaw in OmniAuth-to-LDAP account linking could allow an authenticated user to take over an existing LDAP-backed account. The issue applies when both OmniAuth SAML and LDAP auto-linking are enabled.
CVE-2026-112212 — CVSS 7.5 (High)
An OAuth/OIDC discovery endpoint vulnerability could allow an unauthenticated attacker to poison a shared cache with a manipulated discovery document, potentially redirecting certain authentication flows to an externally controlled server.
CVE-2026-12664 — CVSS 6.8 (Medium)
Insufficient scope enforcement in a GraphQL field could allow an authenticated user with a read_api-scoped token to retrieve a project’s incoming email address and create work items beyond the token’s intended restrictions.
CVE-2026-16255 — CVSS 5.9 (Medium)
In GitLab EE, incomplete enforcement of instance-wide SAML/LDAP membership locks could allow authenticated users to grant or accept project and group memberships outside the identity provider’s control in certain circumstances.
CVE-2026-105777 — CVSS 4.3 (Medium)
Insufficient filtering of internal response headers could expose sensitive internal server credentials under certain conditions.
CVE-2026-13319 — CVSS 4.3 (Medium)
An authorisation bypass in the group milestones API could allow authenticated users to retrieve milestone metadata, including titles, descriptions and project paths, from private projects without project membership.
CVE-2026-112378 — CVSS 4.3 (Medium)
A server-side validation weakness in GitLab EE’s AI Gateway feature could allow authenticated users to access paid AI features without a valid subscription under certain conditions.
The release also addresses four lower-severity issues:
- CVE-2026-105711 — CVSS 3.5: Confidential issue titles could be exposed when a merge request in a public project referenced an issue in a private project.
- CVE-2026-14288 — CVSS 3.1: An access-control weakness could allow an authenticated user to bypass a required merge request approval policy on a protected branch.
- CVE-2026-112326 — CVSS 3.1: An error-handling issue could allow an authenticated user with read-only permissions to delete existing vulnerability records.
- CVE-2026-103515 — CVSS 2.7: A group Owner could re-enable AI-backed data sharing with a third-party service despite an administrator’s group-level Duo availability lock.
These issues affect different GitLab versions and, in some cases, only Enterprise Edition.
Fixed versions
GitLab published the following patched releases for self-managed installations:
- 19.5.1
- 19.4.3
- 19.3.6
- 19.2.9
- 19.1.9
- 19.0.10
- 18.11.13
For CVE-2026-110264, the affected ranges are all versions from 7.0 before 18.11.13; 19.0 before 19.0.10; 19.1 before 19.1.9; 19.2 before 19.2.9; 19.3 before 19.3.6; 19.4 before 19.4.3; and 19.5 before 19.5.1.
The remaining vulnerabilities have their own affected-version ranges. Administrators should check the individual CVE entries in GitLab’s advisory to confirm the status of their installed version.
Recommended action
GitLab recommends that affected self-managed installations upgrade to the appropriate patched release immediately.
Administrators should identify their installed GitLab versions, determine which release branch they are running and follow the documented upgrade procedure.
The upgrade requires downtime on single-node installations while database migrations run. Multi-node deployments can avoid downtime by following GitLab’s documented zero-downtime upgrade procedure.
GitLab.com is already running a patched version. GitLab Dedicated tenants running 19.3.5-internal0 or 19.4.2-internal0 and later already include the fixes and do not need to take additional action for this release.
