Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases
Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases — [https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEig4
What’s new: GitLab has released fixes for a critical vulnerability (CVE-2026-110264) rated 10.0 on the CVSS scale, which allows unauthenticated remote code execution (RCE) on self-managed servers. This flaw affects all versions from 7.0 to the latest, with the fix released on October 21, 2026. Administrators who updated on October 12 need to apply the new patch as it addresses a broader range of versions.
Who’s affected
All self-managed GitLab installations from version 7.0 to the latest are affected. GitLab.com and GitLab Dedicated tenants on specific internal releases are not impacted as they already run the fixed version.
What to do
- Upgrade to the following patched versions:
- 19.5.1
- 19.4.3
- 19.3.6
- 19.2.9
- 19.1.9
- 19.0.10
- 18.11.13
- Implement the provided detection rules for exploitation attempts: “Onigmo native worker crash” and “Org mode render error burst”.
- Plan for potential downtime during the upgrade, especially for versions 19.4.3 and 19.3.6 due to database changes.
