Skip to content
GitLab CVE-2026-110264: Critical RCE Flaw Patched

GitLab CVE-2026-110264: Critical RCE Flaw Patched

First seen 28 Oct 2026, 05:47 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 29, 2026 at 05:39 UTC
  • •CVE-2026-110264 has a CVSS score of 10.0, indicating critical severity.
  • •The vulnerability allows unauthenticated remote code execution on self-managed GitLab servers.
  • •Seven branches were patched, including the latest release 19.5.1, just days after its launch.

GitLab released emergency patches for CVE-2026-110264 on October 21, 2026, addressing a critical remote code execution vulnerability in its regular expression compiler. The flaw, which has a CVSS score of 10.0, allows unauthenticated attackers to execute arbitrary code on self-managed servers. This vulnerability affects all self-managed GitLab Community and Enterprise Editions since version 7.0, released in 2014. GitLab backported the fix to seven branches, including 19.5.1, which was released just six days after the previous version. The researcher Johan Carlsson reported this vulnerability through GitLab's HackerOne bug bounty program. GitLab.com is not affected as it runs the patched code, leaving self-hosted instances at risk. This incident follows another critical vulnerability (CVE-2026-97229) disclosed just ten days earlier, indicating a concerning trend in the GitLab CI/CD regex compiler.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 1d ago How this analysis works

Timeline

2026-09-11
CVE-2026-85706 added to CISA KEV
CISA flagged the vulnerability as actively exploited in the wild and added it to the Known Exploited Vulnerabilities catalog.
CISA KEV
2026-10-13
CVE-2026-97229 published
A critical RCE vulnerability in GitLab's CI lint regex was disclosed with a CVSS score of 10.0.
Sploitus
2026-10-21
CVE-2026-110264 patched
GitLab released emergency fixes for a critical RCE flaw affecting self-managed servers, backporting to seven branches.
Shattered
2026-10-21
CVE-2026-112212 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-21
CVE-2026-15723 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-22
CVE-2026-110264 published
The vulnerability was officially disclosed with a CVSS score of 10.0, allowing unauthenticated code execution.
Shattered

More articles in this cluster (20)

Following this threat?

Track CVE-2021-22175 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (18)

1 / 4

Common questions

Which GitLab versions are affected?
All self-managed GitLab Community and Enterprise Editions since version 7.0 are affected.
Is there a proof of concept available?
Yes, proof of concept code for CVE-2026-110264 was made public shortly after its disclosure.
What should I do if I'm using a self-managed GitLab instance?
Immediately apply the latest patches provided by GitLab to mitigate the risk of exploitation.