# GitLab patches critical unauthenticated RCE flaw

Published: 2026-10-22 · Severity: routine · Sectors: Technology
Canonical: https://vorant.io/reports/19224b4d-e7ef-52a8-b0a1-c271bcf83b2e/gitlab-patches-critical-unauthenticated-rce-flaw

> GitLab fixed a maximum-severity (CVSS 10.0) unauthenticated RCE flaw plus 11 other bugs; no active exploitation reported yet.

NCSC-NL published an advisory covering 12 vulnerabilities patched by GitLab in Community Edition and Enterprise Edition. The most severe, CVE-2026-110264 (CVSS 10.0), is an integer overflow triggered when GitLab compiles a specially crafted regular expression, allowing an unauthenticated attacker to remotely execute arbitrary code on the GitLab server. This flaw affects versions from 7.0 onward, meaning essentially all self-managed GitLab deployments are at risk until patched. GitLab has released two detection rules ("Onigmo native worker crash" and "Org mode render error burst") for self-managed administrators to hunt for exploitation attempts, and states no active exploitation has been observed so far.

Two additional high-severity issues were also addressed: CVE-2026-15723 (CVSS 8.2), which allows an authenticated attacker to take over an existing account under specific SAML/LDAP configurations, and CVE-2026-112212 (CVSS 7.5), an OAuth/OIDC discovery endpoint cache-poisoning flaw that can redirect certain authentication flows to an attacker-controlled server. The remaining nine lower-severity vulnerabilities cover issues such as LDAP injection, HTTP request smuggling, sensitive information disclosure, and access-control bypasses.

GitLab.com has already been updated, and GitLab Dedicated instances running 19.3.5-internal0, 19.4.2-internal0 or later already contain the fixes. Self-managed administrators should upgrade immediately to 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3, or 19.5.1, and apply the published detection rules to check for exploitation attempts against the critical flaw.

## Mentioned in this report

- Vulnerabilities: CVE-2026-103515, CVE-2026-105711, CVE-2026-105777, CVE-2026-110264, CVE-2026-112212, CVE-2026-112326, CVE-2026-112378, CVE-2026-12664, CVE-2026-13319, CVE-2026-14288, CVE-2026-15723, CVE-2026-16255

Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0447.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/19224b4d-e7ef-52a8-b0a1-c271bcf83b2e/gitlab-patches-critical-unauthenticated-rce-flaw.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup