top of page

Critical Unauthenticated Remote Code Execution Vulnerability in GitLab CE/EE via Regular Expression Compiler Integer Overflow (CVE-2026-110264)

October 22nd, 2026

Critical

Our Cyber Threat Intelligence Unit is monitoring a critical vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE), CVE-2026-110264, which could allow an unauthenticated attacker to execute arbitrary code on the GitLab server. GitLab describes the cause as an integer overflow during compilation of a specially crafted regular expression, and its detection notes indicate the attack path lies in rendering Org-mode (.org) files from a public project. It affects all CE and EE versions from 7.0 up to the fixed releases of October 21, 2026. GitLab rated it 10.0 on CVSS 3.1, and NVD has not yet provided its own score. GitLab.com and GitLab Dedicated are already patched, so remediation falls to self-managed instances. The sources reviewed report no exploitation in the wild, no confirmed public proof-of-concept, and no linked threat actor. The CVE is not in the CISA Known Exploited Vulnerabilities (KEV) catalog. GitLab warns that a successful exploit can be quiet, so a lack of detection hits does not clear an instance. Organizations should prioritize upgrading internet-facing self-managed GitLab. 

Technical Details

  • Threat Type: Unauthenticated remote code execution; integer overflow in the regular expression compiler of Onigmo, Ruby’s regular expression engine (CWE-190 per the CVE record; GitLab’s detection notes also cite CWE-94 and CWE-787)

  • CVE ID: CVE-2026-110264

  • Severity: Critical (CVSS 3.1 10.0 per GitLab as CNA; vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). NVD assessment pending (status: Awaiting Enrichment).

  • Authentication: None required; no user interaction. GitLab says exploitation is possible “under certain conditions” and has not listed them.

  • Threat Actors: None identified.

  • Reported By: joaxcar, through HackerOne (GitLab, BleepingComputer).

  • Affected Systems:

    • Self-managed GitLab CE and EE: all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 (GitLab, NVD).

    • Fixed versions: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13. The last four are backports. Versions older than 18.11 are affected and have no fixed release of their own (GitLab, NVD, Konfirmity).

    • Instances on the October 12, 2026 releases (19.4.2, 19.3.5, 19.2.8), which fixed the separate CVE-2026-97229, remain affected (GitLab, NVD).

    • Not affected: GitLab.com and GitLab Dedicated tenants on 19.3.5-internal0 or 19.4.2-internal0 and later (GitLab).

    • GitLab’s fix backports upstream Ruby commit 493d26dc (pull request 16801) to Ruby 3.3, 3.4, and 4.0. The fix exists only on upstream Ruby master, so Ruby builds without it remain exposed (GitLab omnibus-gitlab MR 9921, Lilting).

  • Exploit Status: No exploitation reported; no confirmed public proof-of-concept.

    • GitLab’s release post does not report exploitation. NCSC-NL states that no evidence of active exploitation is known and rates its likelihood as medium.

    • Public exploit work exists only for the related CVE-2026-97229 (Rapid7 analysis and reproduction). A GitHub repository titled for CVE-2026-110264 states in its README that its script implements the CVE-2026-97229 chain and is unverified for this CVE, so it is not treated as a proof-of-concept (Rapid7, repository README).

  • Related Vulnerabilities: CVE-2026-97229 (a bypass of CVE-2026-93577) is a separate compile-time overflow in GitLab’s CI regexp path. CVE-2026-110264 is in the Org-mode path, with a match-time out-of-bounds write (GitLab detection notes). The October 21 release also fixes other vulnerabilities, which are outside the scope of this advisory (NCSC-NL).

  • Timeline:

    • April 29, 2026: upstream Ruby fix merged (Ruby).

    • October 12, 2026: GitLab fixes the separate CVE-2026-97229 in 19.4.2, 19.3.5 and 19.2.8 (GitLab).

    • October 20, 2026: date on GitLab’s detection rules (GitLab detection notes).

    • October 21, 2026: GitLab releases the fixed versions, and the CVE appears in NVD (GitLab, NVD).

  • Attack Chain:

    • Initial Access: A crafted Org-mode (.org) file in a public project that GitLab renders; no account is needed. The editor preview picks the renderer from the supplied file_path, so a .org path forces the Org renderer onto any file (GitLab detection notes).

    • Exploitation Method: The org-ruby gem (0.9.12) builds a regular expression from the raw keyword on a #+TODO: line (also #+SEQ_TODO: or #+TYP_TODO:), giving the attacker control of the expression source. A keyword with more than 32,767 generic repeats makes Onigmo assign a repeat ID past the signed 16-bit limit. The ID wraps negative, and the repeat opcode writes out of bounds at match time (GitLab detection notes).

    • Code Execution: With heap grooming driven by the request body, the write becomes a system() call as the git user (GitLab detection notes).

    • Attempt Outcomes: The attack is noisy, and most attempts do not land cleanly. Each attempt either times out the renderer (logged as Timeout::Error), crashes the worker (Workhorse 502, no Rails log entry), or completes silently, which can precede success (GitLab detection notes).

    • Post-Exploitation: Code execution as the git user (see Section 3.0). No malware, persistence or command and control is documented.

Image by ThisisEngineering

Impact

  • Remote Code Execution: Arbitrary code execution on the GitLab server as the git user by an unauthenticated attacker (GitLab, GitLab detection notes).

  • Credential and Secret Exposure: gitlab-secrets.json, all CI/CD variables, runner tokens and access tokens (GitLab detection notes).

  • Repository Compromise: Read and write access to every repository on the instance (GitLab detection notes).

  • Service Degradation: Worker crashes and degraded service during an attack campaign (GitLab detection notes).

  • Broad Exposure: Shadowserver tracks over 2,700 internet-exposed GitLab CE instances; the figure does not state how many are vulnerable (BleepingComputer).

  • Limiting Conditions: The unauthenticated path needs a public project that can hold the .org payload, and GitLab has not published the full exploitation conditions (GitLab detection notes, GitLab).

Detection Method

  • GitLab released two Sigma detections for self-managed instances, “Org mode render error burst” and “Onigmo native worker crash”. NCSC-NL advises administrators to use them (GitLab, NCSC-NL).

  • Org mode render error burst: alert when one client triggers five or more Timeout::Error exceptions from the OtherMarkup renderer on .org files within 30 minutes. Source: exceptions_json.log (Omnibus: /var/log/gitlab/gitlab-rails/exceptions_json.log; Helm: Webservice pods; source install: /home/git/gitlab/log/exceptions_json.log). Key fields are exception.class, extra.class_name, extra.file_name and meta.client_id, which reads ip/<address> for an unauthenticated client. Tune the threshold for instances that host large legitimate .org files (GitLab detection notes).

  • Editor preview mismatch: alert on a Projects::BlobController#preview request in production_json.log whose file_path ends in .org while the URL is not an .org file. GitLab treats any such hit as notable (GitLab detection notes).

  • Onigmo native worker crash: alert on a Ruby [BUG] crash report in puma_stderr.log (Omnibus: /var/log/gitlab/puma/) that also references org-ruby (for example headline.rb) or Onigmo frames such as match_at, onig_search_gpos and rb_str_sub_bang. GitLab calls this a corroborating rule. It also matches the CI-path frames for CVE-2026-93577 and CVE-2026-97229, so a hit does not by itself identify this CVE (GitLab detection notes).

  • Workhorse 502 correlation: a crashing request returns a Workhorse 502 on the .org blob route and leaves no Rails log entry or correlation_id, so join on host and time (GitLab detection notes).

  • Payload scan: search .org files in suspect repositories for oversized #+TODO:, #+SEQ_TODO: or #+TYP_TODO: lines. GitLab’s example flags lines of 500 or more characters (GitLab detection notes).

  • Hunt for code execution: unexpected child processes of Puma, new files owned by git in /tmp, outbound connections, changed crontabs or SSH keys for the git user, and ArgumentError exceptions from corrupted cache reads (GitLab detection notes).

  • Confirm the pipeline collects exceptions_json.log, production_json.log, puma_stderr.log and ideally the Workhorse log, as native crash reports are often not shipped by default. A lack of hits does not clear an instance, because a successful exploit is quiet and does not reliably crash (GitLab detection notes).

Indicators of Compromise

No IOCs available.

GitLab has published behavioral detections only. IP addresses in GitLab’s sample logs are documentation examples, not indicators.

mix of red, purple, orange, blue bubble shape waves horizontal for cybersecurity and netwo

Recommendations

  • Upgrade self-managed GitLab to 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 or 18.11.13. GitLab states all self-managed installations should be upgraded immediately (Rescana, quoting GitLab), and NCSC-NL and CSA Singapore advise the same. GitLab.com and GitLab Dedicated need no action (GitLab).

    • Instances already on the October 12 releases still need an October 21 version (GitLab, NVD).

    • Instances older than 18.11 need GitLab’s supported upgrade path, including required stops (Rescana, Lilting).

    • Single-node upgrades have downtime because migrations must finish first; multi-node instances can use GitLab’s zero-downtime procedure. Regular migrations are in 19.4.3 and 19.3.6, and post-deploy migrations in 19.4.3 (GitLab).

    • Organizations that build or bundle their own Ruby need a build with upstream commit 493d26dc, as the GitLab package fix does not cover source installs on system Ruby (GitLab omnibus-gitlab MR 9921, Lilting).

  • Until patched, reduce public visibility of the instance where possible, as the unauthenticated path needs a public .org file (GitLab detection notes). This narrows the path but does not close the vulnerability (Konfirmity). GitLab has published no workaround (GitLab).

  • Deploy GitLab’s detections, the payload scan, and the Workhorse 502 correlation described in Section 4.0 (GitLab detection notes).

  • On a suspected attempt, block the source IP, remove or make private the project holding the payload, delete the payload commits, and preserve exceptions_json.log, production_json.log, application_json.log, Workhorse logs, and the payload files as evidence (GitLab detection notes).

  • If signs of code execution are found, treat the instance as compromised and rotate the secrets in gitlab-secrets.json, all CI/CD variables, runner tokens, and access tokens (GitLab detection notes). Also rotate downstream credentials such as cloud keys, as changing a GitLab variable does not revoke the key at its source (Lilting).

Conclusion

CVE-2026-110264 is a critical unauthenticated remote code execution vulnerability in self-managed GitLab CE and EE, reachable through Org-mode rendering from a public project according to GitLab’s detection notes. Fixes were released on October 21, 2026, and the sources reviewed report no exploitation, but GitLab states a successful attack is quiet and does not reliably crash the server. Organizations should upgrade self-managed instances, including those on the October 12 releases, reduce public exposure until patched, and deploy GitLab’s detections, treating an absence of hits as inconclusive.

bottom of page