{"id":2142,"date":"2026-10-23T07:18:49","date_gmt":"2026-10-23T00:18:49","guid":{"rendered":"https:\/\/vncybers.vn\/gitlab-cve-2026-110264-rce-cvss-10-khong-can-xac-thuc\/"},"modified":"2026-10-23T07:18:49","modified_gmt":"2026-10-23T00:18:49","slug":"gitlab-cve-2026-110264-cvss-10-unauthenticated-rce-2","status":"publish","type":"post","link":"https:\/\/vncybers.vn\/en\/gitlab-cve-2026-110264-rce-cvss-10-khong-can-xac-thuc\/","title":{"rendered":"GitLab Issues Emergency Fix for CVE-2026-110264, a CVSS 10 Unauthenticated RCE"},"content":{"rendered":"

GitLab has issued an emergency fix for CVE-2026-110264<\/strong>, a CVSS 10.0 remote code execution vulnerability in the regular expression compiler used by GitLab Community Edition (CE) and Enterprise Edition (EE). Under certain conditions, an attacker without an account can submit a specially crafted regular expression to execute arbitrary code on a self-managed GitLab server.<\/p>\n

\"Server
Self-managed GitLab servers in the affected version ranges must be updated immediately. Photo: Brett Sayles\/Pexels.<\/figcaption><\/figure>\n

GitLab Releases an Emergency Fix<\/h2>\n

In a release notice dated October 21, 2026, GitLab said versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13 address CVE-2026-110264 along with several other security flaws. The company recommends that every affected self-managed installation upgrade to the appropriate patched version as soon as possible.<\/p>\n

GitLab.com is already running a patched version. GitLab Dedicated tenants using 19.3.5-internal0, 19.4.2-internal0, or later also include the fix and need no additional action. Response efforts therefore center on organizations operating GitLab CE or EE on their own servers, virtual machines, and container clusters.<\/p>\n

How Dangerous Is CVE-2026-110264?<\/h2>\n

The vulnerability stems from an integer overflow in the Regular Expression Compiler, a background component used to parse and validate regular expressions in configuration files. According to GitLab, compiling a specially crafted expression can lead to arbitrary code execution on the server.<\/p>\n

The published CVSS 3.1 vector is AV:N\/AC:L\/PR:N\/UI:N\/S:C\/C:H\/I:H\/A:H. This indicates network exploitation with low complexity, no privileges, and no user interaction, with potentially severe effects on system confidentiality, integrity, and availability.<\/p>\n

Affected GitLab Version Ranges<\/h2>\n

The affected range extends from GitLab 7.0 through unpatched releases across several current branches. Specifically, organizations should treat versions from 7.0 before 18.11.13; 19.0 before 19.0.10; 19.1 before 19.1.9; 19.2 before 19.2.9; 19.3 before 19.3.6; 19.4 before 19.4.3; and 19.5 before 19.5.1 as vulnerable.<\/p>\n

GitLab backported the fix to the 18.11, 19.0, 19.1, and 19.2 branches in addition to its standard releases. Administrators should still choose the latest release in a supported branch rather than stopping at the minimum patched build because the same update also resolves multiple authentication, access-control, and information-disclosure issues.<\/p>\n

Why Is a GitLab Server a High-Value Target?<\/h2>\n

A GitLab server commonly stores source code, change history, issues, internal documentation, and development workflow data. Depending on its configuration, it may also have access to CI\/CD tokens, environment variables, registries, runners, and credentials used for software deployment.<\/p>\n

After successful code execution, an attacker could search for secrets, modify code or pipeline configurations, maintain persistence, and expand into build infrastructure or production environments. The incident therefore threatens more than one server and could become the starting point for a software supply-chain attack.<\/p>\n

Indicators to Monitor<\/h2>\n

GitLab has published two detection resources for self-managed customers: Onigmo native worker crashes and bursts of Org mode rendering errors. These are signals for hunting exploitation attempts, not standalone proof that a system has been compromised.<\/p>\n

Operations teams should correlate application and reverse-proxy logs, operating-system processes, and network traffic around unusual crashes or errors. Strange child processes, new files, unfamiliar outbound connections, out-of-process repository changes, and tokens used from unusual locations warrant priority investigation.<\/p>\n

Priority Update Workflow<\/h2>\n
    \n
  1. Inventory versions:<\/strong> identify every self-managed GitLab CE\/EE instance, including production, standby, test environments, and deployment images.<\/li>\n
  2. Prioritize internet-exposed systems:<\/strong> temporarily restrict access if an immediate update is impossible, and do not treat a web application firewall as a substitute for patching.<\/li>\n
  3. Back up and upgrade:<\/strong> follow GitLab's upgrade documentation, install the appropriate patch, and then verify the running service and version.<\/li>\n
  4. Hunt for indicators:<\/strong> use the official detection content and review crashes, Org mode errors, and unusual system behavior.<\/li>\n
  5. Respond to suspected compromise:<\/strong> isolate the server, preserve logs, inspect repositories and pipelines, and rotate tokens, deployment keys, and secrets that may have been exposed.<\/li>\n<\/ol>\n

    Other Flaws in the Same Release<\/h2>\n

    The release also fixes CVE-2026-15723, a CVSS 8.2 improper-authentication issue in OmniAuth-to-LDAP linking that could enable an LDAP account takeover under specific configurations. CVE-2026-112212, rated CVSS 7.5, concerns cache poisoning at OAuth\/OIDC discovery endpoints and can redirect certain flows to an attacker-controlled server.<\/p>\n

    The release further addresses medium- and low-severity flaws involving GraphQL, SAML\/LDAP membership locks, internal response headers, the milestone API, AI Gateway, merge request caching, and approval policies. This reinforces the need to deploy the complete patch rather than trying to block only the most severe CVE.<\/p>\n

    The Broader Risk Context for GitLab<\/h2>\n

    Citing Shadowserver data, BleepingComputer reports that more than 2,700 GitLab Community Edition servers were observed exposed to the internet, although this count may include honeypots and patched systems. Ten days before the latest alert, GitLab also addressed another code execution flaw in the Regular Expression Compiler, tracked as CVE-2026-97229.<\/p>\n

    Last month, GitLab fixed CVE-2026-85706, an unauthenticated sensitive-file disclosure flaw that CISA later added to its Known Exploited Vulnerabilities catalog. The closely spaced advisories show that organizations operating DevSecOps platforms need shorter inventory, testing, and patch-deployment timelines.<\/p>\n

    Lessons for Administrators and Development Teams<\/h2>\n

    CVE-2026-110264 underscores that a source-code management platform is a critical part of the supply chain, not merely a collaboration tool. Access controls, network segmentation, and runner monitoring remain necessary, but they cannot remove an unauthenticated code execution flaw in the server component.<\/p>\n

    The proper priority is to update immediately, verify the actual running version, inspect for exploitation indicators, and then reassess secrets and pipeline integrity if compromise is suspected. Organizations should also maintain an inventory of GitLab versions, accountable owners, and patch deadlines to respond quickly to out-of-band security releases.<\/p>\n

    VNCyberS<\/strong> compiled from GitLab and BleepingComputer<\/em><\/p>","protected":false},"excerpt":{"rendered":"

    GitLab \u0111\u00e3 ph\u00e1t h\u00e0nh b\u1ea3n v\u00e1 kh\u1ea9n cho CVE-2026-110264, m\u1ed9t l\u1ed7 h\u1ed5ng th\u1ef1c thi m\u00e3 t\u1eeb xa c\u00f3 \u0111i\u1ec3m CVSS 10.0 trong b\u1ed9 bi\u00ean d\u1ecbch bi\u1ec3u th\u1ee9c ch\u00ednh quy c\u1ee7a GitLab Community Edition (CE) v\u00e0 Enterprise Edition (EE). Trong m\u1ed9t s\u1ed1 \u0111i\u1ec1u ki\u1ec7n, k\u1ebb t\u1ea5n c\u00f4ng kh\u00f4ng c\u1ea7n t\u00e0i kho\u1ea3n c\u00f3 th\u1ec3 g\u1eedi bi\u1ec3u th\u1ee9c […]<\/p>\n","protected":false},"author":2,"featured_media":2141,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[1],"tags":[1000,998,999,757,806,853,36],"class_list":["post-2142","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-tin-tuc","tag-bao-mat-chuoi-cung-ung","tag-cve-2026-110264","tag-cvss-10","tag-devsecops","tag-gitlab","tag-quan-ly-lo-hong","tag-rce"],"_links":{"self":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/2142","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/comments?post=2142"}],"version-history":[{"count":0,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/2142\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media\/2141"}],"wp:attachment":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media?parent=2142"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/categories?post=2142"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/tags?post=2142"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}