GitLab CVE-2026-110264: Pre-Authentication RCE via Integer Overflow in Regular Expression Compiler

1. Overview

• Advisory: GitLab Critical Patch Release: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13
• Published by: GitLab
• Publication Date: 2026-10-21
• Source: GitLab Critical Patch Release: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13
• Related Sources: BleepingComputer: GitLab warns of new max severity code execution vulnerability
• Related Malware / Threat Groups: Unidentified
• Associated CVE: CVE-2026-110264
• Affected Products: GitLab CE, GitLab EE, Regular Expression Compiler
• Severity: Critical
• Severity Rationale: A CVSS 10.0 unauthenticated remote code execution (RCE) vulnerability affecting self-managed GitLab servers, with potential impact on repositories and CI/CD secrets accessible to the execution process. No active exploitation has been confirmed at this time.

2. Quick Summary

An integer overflow occurs during the compilation of crafted regular expressions, allowing unauthenticated remote attackers to potentially execute arbitrary code on the GitLab server. GitLab has also released two queries to detect potential exploitation attempts.

3. Attack Flow

Reconstructed Attack and Exploitation Chain from Public Information

1. An unauthenticated attacker sends an input containing a crafted regular expression to a vulnerable processing path in GitLab (specific entry conditions are not publicly disclosed).
2. An integer overflow occurs while the regular expression compiler processes the input.
3. Memory corruption could lead to arbitrary code execution under the privileges of the GitLab server process.
4. If code execution succeeds, it may impact repositories, CI/CD secrets, and other assets accessible to the execution process (progression to runner compromise depends on token availability and environment isolation; actual impact remains unconfirmed).

The table summarizes the public information above. Defender signals are suggestions for investigation in your own environment (Inference). Undisclosed implementation details and follow-on behavior are left unspecified.

4. Attacker Positioning and Execution Location

• An unauthenticated remote attacker with network reachability to vulnerable self-managed GitLab servers.

5. Victim and Administrator Perspective

Victims

• The activity may appear as standard document viewing or configuration handling, making it difficult to identify attacks based solely on user interface displays.

Administrators and SOCs

• May be observed as worker process crashes, a surge in Org mode rendering errors, abnormal child process creation by GitLab processes, or file and secret access.

6. Success and Failure Conditions

Success Conditions

• Running an affected version.
• Delivery of a crafted regular expression to the vulnerable compiler processing path.

Failure Conditions and Mitigations

• Immediately update to the appropriate patched version based on your release series: 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3, or 19.5.1.
• Restrict external network reachability and unauthenticated input paths until updates are complete. If compromise is suspected, revoke and reissue tokens or rebuild runners based on investigation results; these actions do not replace the need to update.

7. Outcome Upon Success

• Arbitrary code execution on the GitLab server.
• Unauthorized access to repositories, CI/CD secrets, and runner-related tokens readable under the execution process privileges.
• Potential source code modification or software supply chain compromise.

8. Observable Logs

Inference: The items below are candidates for internal investigation. Availability depends on products, permissions, configurations, and retention periods, and should be distinguished from confirmed observations in source reports. Do not attribute an event to this issue or confirm successful compromise based on a single indicator alone.

Email

• No email vectors specific to this issue have been published.

Proxy / SWG / DNS

• Correlate HTTP requests and responses directed to GitLab with official detection guidance for Onigmo native worker crashes or surges in Org mode rendering errors (specific request signatures are not identified in this material).

Endpoint / EDR

• Review accessible logs for Onigmo native worker crashes, rendering errors, child process creation by GitLab processes, and core dumps. A crash alone does not confirm that RCE was successful.

Identity / IdP

• Check for unusual session establishments, unauthorized use of access tokens, and account privilege modification histories as post-incident investigation candidates.

SaaS / Cloud

• Review GitLab audit logs, repository and pipeline change histories, and CI/CD variable and runner registration/usage histories.

Network

• Investigate outbound communications from the GitLab host following anomalous requests, or unusual network connections to runners and internal services.

9. Assessing Attack Success

Confirmed in Public Information

GitLab has published information regarding the potential for unauthenticated RCE, affected versions, patch versions, and two queries for detecting exploitation attempts. Public sources reviewed do not confirm actual exploitation cases or successful RCE in individual environments.

Internal Evaluation Criteria

• Exploitation Attempt Observed (Success Unconfirmed): Matches with official detection queries, rendering errors, or worker crashes alone do not indicate successful RCE. Carefully verify differences between request contents and normal behavior.
• Initial Execution Confirmed: Supported by evidence of arbitrary code execution corresponding to crafted requests or the launch of unauthorized child processes. Repository modifications and secret theft must be verified as separate stages.

10. Investigation Playbook

• Triggers: Operation of affected versions, Onigmo worker crashes, or surges in Org mode rendering errors.
• Initial Review: Verify running versions, deployment architecture, external exposure status, error logs, and matches with official detection queries.
• Endpoint and Server Investigation: Preserve process trees, core dumps, file integrity, and service account activity histories on the GitLab host.
• Authentication and Cloud Investigation: Check access tokens, CI/CD variables, runner registration status, and historical usage of connected cloud credentials.
• Follow-on Activity: Track repository modifications, unauthorized pipeline execution, runner compromise, secret exfiltration, and internal lateral movement.
• Containment: Apply patches, restrict reachability, revoke and reissue suspected tokens and secrets, and rebuild runners.
• Assessment Levels: Clearly distinguish between contact, execution, authentication success, data access, and follow-on compromise stages; do not presume unconfirmed success.

11. Defense and Detection Ideas

• Single Events: Detect Onigmo native worker crashes, surges in Org mode rendering errors, and shell execution originating from GitLab processes.
• Time-Series Correlation: Correlate the sequence of HTTP requests, compiler errors/crashes, child process creation, secret access, and outbound communication.
• Threat Hunting: Search proactively across pre-patch timeframes for sudden error spikes, worker crashes, anomalous process trees, and runner or token usage histories.
• Log Limitations: Because exploit details are not public, combining vendor-provided queries with host telemetry is essential.
• Priority Actions: Immediately update to patched versions, restrict external access, minimize CI secrets, isolate runner environments, and ensure long-term retention of audit logs.

12. Facts, Inferences, and Hypotheses

Facts

• GitLab published CVE-2026-110264 with a CVSS severity score of 10.0.
• An integer overflow occurring during the compilation of crafted regular expressions may allow unauthenticated external users to execute arbitrary code on the server under specific conditions.
• Multiple series of GitLab CE/EE from version 7.0 onward are affected, with patches released in versions 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3, and 19.5.1.
• GitLab.com has been patched. GitLab Dedicated tenants running 19.3.5-internal0 or 19.4.2-internal0, or later releases containing the fixes, do not need to take additional action.
• GitLab published two queries to detect Onigmo native worker crashes and surges in Org mode rendering errors.

Inferences

• If RCE is achieved, the impact could expand to repositories, runner-related tokens, CI/CD environment variables, and connected cloud credentials.

Hypotheses

No additional hypotheses. Unverified items are documented under Open Questions and Further Investigation.

13. MITRE ATT&CK Mapping

14. Open Questions and Further Investigation

• The specific structure of crafted regular expressions and exploitable entry endpoints.
• Existence of public proof-of-concept code, exploitation in the wild, or reliable host-side artifacts.

15. Impact on SOCs and Organizations

Organizations operating self-managed GitLab instances for internet-facing services or external joint development should immediately update to patched versions across their deployed series, and use official GitLab detection queries along with host telemetry to conduct retrospective investigations for the pre-patch period.

16. Summary by Target Audience

• For SOCs: Correlate and monitor for Onigmo worker crashes, surges in Org mode rendering errors, child process creation from GitLab processes, and secret access.
• For Administrators: Immediately update self-managed GitLab instances to the patched versions for their respective series, and restrict external reachability until updates are complete.
• For Users: GitLab.com users require no additional actions. Self-managed environment users should follow their administrator's update guidance.