GitLab Patches Perfect-10 Flaw Letting Hackers Run Code Without Login

GitLab released urgent security updates on Wednesday, 21 October, for its self-managed Community and Enterprise editions, fixing a flaw rated the maximum 10.0 that could let an attacker run code on a GitLab server without logging in. The bug, CVE-2026-110264, is an integer overflow in the software’s regular expression compiler and affects versions as far back as 7.0, about 12 years of releases. Companies use self-managed GitLab to store their source code and run their software builds on their own servers.

Versions 18.11.13 to 19.5.1 Carry the Fix

The patched releases are 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13, according to Security Online. Any self-managed server running an older version in those lines is exposed. GitLab.com and GitLab Dedicated customers are already protected, the report said, so the work falls on organisations that host GitLab themselves.

The flaw was reported by a researcher known as joaxcar. A CVSS score of 10.0 means it can be attacked over the network, needs no password and no help from a user, and gives the attacker full control of the affected system.

Eleven More Bugs in the Same Release

The release fixes 12 problems in all: one critical, two high, five medium and four low. The high-rated ones are CVE-2026-15723 (8.2), which lets a logged-in attacker take over LDAP-backed accounts on servers that use both SAML and LDAP auto-linking, and CVE-2026-112212 (7.5), a cache-poisoning bug in OAuth and OpenID Connect discovery that could send login traffic to an outside server.

The medium and low bugs cover leaks of project email addresses and milestone details, a bypass of SAML and LDAP membership locks, exposure of internal credentials in response headers and a way around merge approval policies.

No Known Attacks, but Admins Told to Upgrade Now

No public proof-of-concept exploit exists and no attacks have been confirmed for any of the 12 flaws, Security Online reported. GitLab still urged self-managed customers to upgrade straight away. Administrators were also told to check server logs for crashes of the Onigmo native worker or bursts of Org mode rendering errors, which could point to attempts on the critical bug.

The GitLab fix landed on the same day as emergency patches for two critical PHP flaws and a Node.js security release. More reports are in Daily Updates.

Based on reporting by Security Online and GBHackers.

Image: Security Online.