GitLab — Critical Regular Expression Engine Flaw Allows Unauthenticated RCE Across Self-Managed Instances (CVE-2026-110264)

Publication date: October 21, 2026
Category: Vulnerability / Software Security

Introduction

On October 21, 2026, GitLab issued emergency security advisories to address a critical, unauthenticated remote code execution (RCE) vulnerability affecting virtually the entire operational history of self-managed instances. Discovered by researcher joaxcar—who has identified multiple flaws within the regular expression engine over the past month—the issue impacts every version of GitLab released since version 7.0 in 2014. Tracked as CVE-2026-110264, the vulnerability carries a maximum CVSS v3.1 score of 10.0 and demands immediate remediation by infrastructure administrators, even for environments that applied patches just days prior.

What is CVE-2026-110264? (General Analysis)

The vulnerability CVE-2026-110264 lies in how GitLab handles and compiles regular expressions within continuous integration and continuous deployment (CI/CD) configurations. Specifically, the flaw stems from an integer overflow during the compilation of maliciously crafted regular expressions within the platform’s internal regex engine.

The scope of this vulnerability is extraordinary because the compromised component is not native GitLab-exclusive code, but rather Ruby’s built-in regular expression engine, known as Onigmo. By shipping and patching this engine internally across its builds, GitLab embedded this architectural weakness across 12 years of software releases.

  • Official CVSS Vector (estimated/analogous to engine sibling vulnerabilities): CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H — 10.0 (CRITICAL).
  • Official CWE Classification related to regex overflows in the series: CWE-190 (Integer Overflow or Wraparound).
  • CISA KEV Status: Not listed in the Known Exploited Vulnerabilities catalog as of October 22, 2026.

How Does It Work? (Technical Analysis)

The exploitation mechanism relies on interactions with the pattern-compilation subsystem (regex) inside CI/CD pipelines:

  • Exploit Entry Flow: An unauthenticated attacker submits a CI/CD configuration specifically crafted with complex or oversized regular expressions. The server processes this input to compile it within the Onigmo engine.
  • Overflow and Execution Mechanism: During memory allocation calculations for compiling the malicious pattern, an integer overflow occurs (CWE-190). This corrupts the dynamic memory structures of the server process, enabling the attacker to alter the execution flow and execute arbitrary commands under the privileges of the GitLab service.
  • Absence of Known Preconditions: To date, the vendor has not disclosed the exact preconditions required for an attacker to reach the compiler, preventing administrators from ruling out exposure via configuration changes. Software updating remains the only certain protection.

Affected Systems / Environments

The flaw impacts all self-managed GitLab CE/EE installations from version 7.0 up to versions prior to the recent patches. Cloud-hosted services managed directly by the vendor (GitLab.com and GitLab Dedicated) are already protected.

CVE Category (CWE) Impact CVSS Vector (summarized)
CVE-2026-110264 CWE-190 (Estimated) Unauthenticated RCE 10.0 (Critical) AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVE-2026-97229 CWE-190 Unauthenticated RCE 10.0 (Critical) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVE-2026-93577 CWE-190 Authenticated RCE 9.9 (Critical) CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVE-2026-89078 CWE-415 Authenticated RCE 9.9 (Critical) CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
CVE-2026-15723 Unspecified Account Takeover (SAML/LDAP) 8.2 (High) Network/Low Priv/Low Complexity
CVE-2026-112212 Unspecified Cache Poisoning (OAuth/OIDC) 7.5 (High) Network/Low Priv/Low Complexity

Version Matrix and Required Upgrades

  • Versions 19.5 prior to 19.5.1 $\rightarrow$ Upgrade to 19.5.1
  • Versions 19.4 prior to 19.4.3 $\rightarrow$ Upgrade to 19.4.3
  • Versions 19.3 prior to 19.3.6 $\rightarrow$ Upgrade to 19.3.6
  • Versions 19.2 prior to 19.2.9 $\rightarrow$ Upgrade to 19.2.9
  • Versions 19.1 prior to 19.1.9 $\rightarrow$ Upgrade to 19.1.9
  • Versions 19.0 prior to 19.0.10 $\rightarrow$ Upgrade to 19.0.10
  • Versions 7.0 through 18.11 prior to 18.11.13 $\rightarrow$ Upgrade to 18.11.13

Mitigation and Detection

Remediation

  • Immediate Patching: Apply the corresponding version branch patch immediately. Note that upgrades to 19.4.3 and 19.3.6 include database migrations that run during the upgrade process, requiring downtime on single-node servers. Multi-node setups can apply zero-downtime procedures.
  • Exceptional Backports: GitLab backported fixes to historical versions (18.11.13, 19.0.10, 19.1.9, 19.2.9), a step reserved exclusively for severe issues.

Detection

Defensive teams should audit application logs for native engine worker anomalies and overflows. GitLab has published Sigma-format detection rules via its open-source TLDR framework, notably:

  • Onigmo native worker crash
  • Org mode render error burst

Operational Note: “The lack of known preconditions regarding compiler access means administrators cannot rule out exposure via configuration adjustments; applying the official vendor patch remains the only certain protection.”

Wrapping Up

Vulnerability CVE-2026-110264 represents one of the broadest and most severe security flaws in recent GitLab history, impacting over a decade of self-managed software releases through the Onigmo engine. With a CVSS score of 10.0 and an unauthenticated code execution vector, it highlights the underlying complexity of managing third-party dependencies and bundled engines. System administrators must prioritize applying the designated patches and leveraging the provided Sigma rules to hunt for potential exploitation attempts across their logs.

References