GitLab released critical updates on October 21 for a flaw that could allow unauthenticated users to run code on self-managed servers, affecting every version from 2014.
The vulnerability or weakness
The vulnerability, tracked as CVE-2026-110264, is a flaw in the regular-expression compiler that could enable unauthenticated remote code execution.
| CVE | CVSS | Severity | In CISA KEV | KEV due date |
|---|---|---|---|---|
| CVE-2026-110264 | 10.0 | CRITICAL | No | - |
CVE data: NVD (nvd.nist.gov) and the CISA Known Exploited Vulnerabilities catalog.
Earlier attacks and coverage
- Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code Execution (2026-10-20)
- Researchers Warn OpenCode Quietly Patched Critical RCE Flaw, Leaving Users At Risk (2026-10-20)
Business impact
Organizations that use self-managed GitLab instances are at risk, as the flaw could lead to server compromise and data breaches. Patching is essential to prevent unauthorized access and potential legal repercussions.
Industries affected
This issue affects any industry using self-managed GitLab, including tech, finance, healthcare, and government.
Users affected
Users of self-managed GitLab installations, particularly administrators, must update to the latest versions to mitigate the risk of unauthorized code execution and potential data loss.
