GitLab Patches Critical RCE Bug Affecting Versions Back to 7.0
Updated
Updated · InfoWorld · Oct 22
GitLab Patches Critical RCE Bug Affecting Versions Back to 7.0
3 articles · Updated · InfoWorld · Oct 22
Summary
GitLab released patched CE and EE versions after disclosing CVE-2026-110264, a critical integer-overflow flaw that could let unauthenticated users execute arbitrary code on GitLab servers.
Affected releases span from version 7.0 through multiple current branches; fixes are available in 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13.
A second fix, CVE-2026-15723, closes a high-severity authentication flaw that could let an authenticated user take over an LDAP-backed account when OmniAuth SAML and LDAP auto-linking were both enabled.
Analysts urged immediate patching because GitLab often stores source code, CI/CD pipelines and deployment secrets, while the update may require downtime due to database migrations on single-node instances.
The disclosure marks GitLab's fourth critical issue in two months and suggests broader risk beyond GitLab itself because the root flaw involves Ruby regex handling rather than only GitLab-specific code.
Could the critical flaw in GitLab’s regex engine be silently compromising other Ruby-based applications in your tech stack right now?
If hackers already exploited this unauthenticated vulnerability, are your company's most guarded deployment secrets and source code already in enemy hands?