EDITOR WIRE | 2026-10-21 | BLOCK 972527
BITCOIN $84,696 | GOLD $4,138 | OIL $105.53 | S&P 500 $7,759 | US 10Y 5.13%
GitLab patches critical unauthenticated code-execution flaw across older releases
GitLab has issued an urgent patch for CVE-2026-110264, a CVSS 10.0 flaw in the regular-expression compiler shipped with its Community and Enterprise editions. GitLab says that, under certain conditions, compiling a specially crafted expression could let an unauthenticated attacker run code on a self-managed server. Affected releases extend back to GitLab 7.0. GitLab has not disclosed the conditions needed to reach the vulnerable path, so the rating should not be read as proof that every exposed instance can be compromised with a single request.
The practical risk is control of the server running GitLab. If an attacker can get a crafted expression compiled through the vulnerable path and achieve code execution, they could attempt to access repositories, credentials or other data available to that server. Those are potential consequences of server-side code execution, not reported outcomes of an observed attack. GitLab has published detections for Onigmo native-worker crashes and bursts of Org-mode rendering errors to help self-managed operators investigate possible attempts.
GitLab also fixed separate authentication issues in this release. One could let a logged-in user take over an LDAP-backed account only where both OmniAuth SAML and LDAP auto-linking are enabled. Another could let an unauthenticated attacker poison a shared OAuth/OIDC discovery cache and redirect certain sign-in flows to an attacker-controlled server under affected conditions. Neither has the same prerequisites as the regex-compiler flaw.
Self-managed operators should upgrade promptly to 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 or 18.11.13, according to their release line. GitLab says GitLab.com is patched and specified GitLab Dedicated internal releases already contain the fixes. The 19.4.3 and 19.3.6 upgrades include database migrations; single-node administrators should plan for downtime while they complete.
Sources:
https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/
https://thehackernews.com/2026/10/critical-gitlab-flaw-cvss-100-could.html?m=1
BITCOIN $84,696 | GOLD $4,138 | OIL $105.53 | S&P 500 $7,759 | US 10Y 5.13%
GitLab patches critical unauthenticated code-execution flaw across older releases
GitLab has issued an urgent patch for CVE-2026-110264, a CVSS 10.0 flaw in the regular-expression compiler shipped with its Community and Enterprise editions. GitLab says that, under certain conditions, compiling a specially crafted expression could let an unauthenticated attacker run code on a self-managed server. Affected releases extend back to GitLab 7.0. GitLab has not disclosed the conditions needed to reach the vulnerable path, so the rating should not be read as proof that every exposed instance can be compromised with a single request.
The practical risk is control of the server running GitLab. If an attacker can get a crafted expression compiled through the vulnerable path and achieve code execution, they could attempt to access repositories, credentials or other data available to that server. Those are potential consequences of server-side code execution, not reported outcomes of an observed attack. GitLab has published detections for Onigmo native-worker crashes and bursts of Org-mode rendering errors to help self-managed operators investigate possible attempts.
GitLab also fixed separate authentication issues in this release. One could let a logged-in user take over an LDAP-backed account only where both OmniAuth SAML and LDAP auto-linking are enabled. Another could let an unauthenticated attacker poison a shared OAuth/OIDC discovery cache and redirect certain sign-in flows to an attacker-controlled server under affected conditions. Neither has the same prerequisites as the regex-compiler flaw.
Self-managed operators should upgrade promptly to 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 or 18.11.13, according to their release line. GitLab says GitLab.com is patched and specified GitLab Dedicated internal releases already contain the fixes. The 19.4.3 and 19.3.6 upgrades include database migrations; single-node administrators should plan for downtime while they complete.
Sources:
https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/
https://thehackernews.com/2026/10/critical-gitlab-flaw-cvss-100-could.html?m=1