Max-severity GitLab flaw lets attackers run code on servers - TechTarget
A maximum-severity security flaw affecting GitLab servers since 2014 could let unauthenticated attackers run arbitrary code, prompting the company to release an emergency patch.
GitLab released a patch on Wednesday, Oct. 21, for a critical security flaw (CVE-2026-110264) that could allow unauthenticated remote attackers to execute arbitrary code on self-managed GitLab servers. The Regular Expression Compiler issue has a CVSS rating of 10.0, the maximum severity level.
The vulnerability affects GitLab releases dating back to 2014, prompting the company to backport the fix to four additional branches: 18.11.13, 19.0.10, 19.1.9 and 19.2.9. "GitLab almost never patches branches this old," wrote security analyst Mario Ariel Galarza Mancedo on LinkedIn. "That tells you how serious this is."
Enterprise Impact
According to GitLab, more than half of the Fortune 100 use its DevSecOps platform. Self-hosted GitLab servers often contain sensitive data including proprietary source code, CI/CD secrets, access tokens and connections to production environments, making the flaw particularly dangerous for enterprises.
Threat detection firm SOC Prime warned that exploitation could lead to credential theft, repository manipulation, supply chain attacks, persistence or lateral movement. The company emphasized that "a compromised GitLab server can create downstream supply chain risk even after the original server is remediated."
Recommended Actions
GitLab strongly recommends that customers with self-managed server instances upgrade to a new version as soon as possible. The company also released two threat detection tools to help uncover exploitation attempts. GitLab-managed infrastructure, including GitLab.com and GitLab Dedicated, is reportedly patched.
Because GitLab installations often act as trusted infrastructure within software development pipelines, responders should also determine whether an attacker could have modified source code, artifacts, container images, infrastructure-as-code templates or deployment workflows.
Security teams should inventory and patch self-managed GitLab instances immediately. Experts advise monitoring for unusual activity such as unexpected application crashes, bursts of rendering errors and unexpected shell execution. After upgrading, review GitLab application logs and operating system telemetry for signs of compromise.
Related
