GitLab patches critical unauthenticated code execution flaw as CERT-EU issues advisory

CERT-EU issued a security advisory on Oct. 22, 2026, warning of a critical GitLab flaw that could allow an unauthenticated user to execute arbitrary code on a server, a day after GitLab published its own advisory on Oct. 21, 2026.

The vulnerability is tracked as CVE-2026-110264 and carries a CVSS score of 10. It is an integer overflow in GitLab‘s Regular Expression Compiler, the component that handles regular expressions in configuration files. GitLab said an attacker without authentication could run arbitrary code on the server.

The flaw affects Community and Enterprise Editions starting at version 7.0 and stopping before 18.11.13. It also reaches version 19.0 before 19.0.10, version 19.1 before 19.1.9, version 19.2 before 19.2.9, version 19.3 before 19.3.6, version 19.4 before 19.4.3, and version 19.5 before 19.5.1. Patched releases are 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3, and 19.5.1.

Two high severity flaws, five medium severity flaws, and four low severity flaws were also addressed. GitLab.com already runs the patched version. GitLab Dedicated tenants on 19.3.5-internal0 and 19.4.2-internal0 or later include the fixes and need no action.

CERT-EU says to update affected assets as soon as possible, with internet-facing assets first. It also urges an assessment to spot compromised assets. GitLab released two detection rules to flag exploitation attempts.

CERT-EU prioritizes internet-facing assets. Shadowserver tracks more than 2,700 exposed GitLab Community Edition instances and does not break out how many are honeypots versus systems already secured. More than 30 million people have registered accounts on GitLab’s DevSecOps platform worldwide, and over half of Fortune 100 companies are users, among them Nvidia, T-Mobile, Lockheed Martin, Airbus, and Goldman Sachs.

A researcher using the handle joaxcar brought CVE-2026-110264 to GitLab through its HackerOne bug bounty program. GitLab said all deployment types are affected unless a specific one is called out.

10 days before Oct. 22, 2026, GitLab warned customers about another critical remote code execution vulnerability, CVE-2026-97229, which carries a 10/10 CVSS base score and targets the CI/CD Regular Expression Compiler. GitLab fixed that flaw on Oct. 12, 2026, in versions 19.4.2, 19.3.5, and 19.2.8.

The flaw affects version 19.2 before 19.2.8, version 19.3 before 19.3.5, and version 19.4 before 19.4.2; the patched releases 19.2.8, 19.3.5 and 19.4.2 are not vulnerable. Rapid7 demonstrated code execution on an unpatched GitLab CE image running version 19.4.1, while the same test failed against version 19.4.2 after patching. As of Oct. 13, 2026, there was no confirmed in-the-wild exploitation of CVE-2026-97229.

An attacker must push a harmful CI/CD configuration file and a repository path with UTF-8 characters into a public project branch to exploit CVE-2026-97229. A regular account is enough on self-managed instances that let users create public projects. GitLab identified Johan Carlsson as the HackerOne researcher behind the CVE-2026-97229 report. Rapid7 urged organizations to move affected self-managed instances to a fixed version immediately, outside normal patch schedules.

GitLab addressed CVE-2026-85706 last month, a maximum-severity issue that let unauthenticated attackers read sensitive data from exposed servers. Version 18.7 is the starting point for vulnerable Community and Enterprise Editions, which runs from version 18.7 up to versions earlier than 19.1.8; 19.1.8 itself is patched, 19.2 builds below 19.2.6, and 19.3 builds below 19.3.2. The vendor shipped fixes 19.1.8, 19.2.6, and 19.3.2 on Sept. 10, 2026.

CISA added CVE-2026-85706 to its Known Exploited Vulnerabilities catalog on Sept. 11, 2026, and told federal agencies to lock down their systems within three days. watchTowr replicated the issue and saw behavioral probes through its global honeypot network. GitLab credited researcher s3ntago for the HackerOne report and put out three threat-detection rules to help administrators spot local file inclusion attempts.

Teams should catalog self-managed GitLab instances, check the version on every one, and give priority to servers facing the public internet. If logs show arbitrary files were read, administrators may need to figure out what data those files held and rotate any exposed credentials.

GitLab intends to publish vulnerability issue details 90 days after the release that contains the patch. Going back to November 2021, CISA has marked five GitLab flaws as actively exploited, including one tied to ransomware attacks.