GitLab has shipped a critical patch release for a flaw rated the maximum CVSS 10.0 that, under certain conditions, could let an unauthenticated user execute arbitrary code on a self-managed GitLab server. It is the second perfect-10 GitLab bug this month, following the flaw we reported in GitLab patches perfect-10 flaw letting strangers run code.
The new bug, CVE-2026-110264, is an integer overflow that occurs when GitLab compiles a specially crafted regular expression, according to GitLab's own advisory. GitLab credits researcher joaxcar, who reported it through its HackerOne bug bounty program. The advisory does not describe the attack path beyond that, and it does not say the flaw has been exploited. Hong Kong's HKCERT has also flagged the release.
Every version since GitLab 7.0 is affected
The affected range is unusually long: all GitLab Community Edition and Enterprise Edition versions from 7.0 onward, before 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3 and 19.5.1. GitLab backported this one fix to the 18.11, 19.0, 19.1 and 19.2 branches on top of its normal patch lines. GitLab.com already runs the patched code, and GitLab Dedicated tenants on 19.3.5-internal0, 19.4.2-internal0 or later need no action.
For self-managed customers who want to look for exploitation attempts, GitLab has published two threat detections, named "Onigmo native worker crash" and "Org mode render error burst".
Eleven more fixes ride along
The release fixes 12 vulnerabilities in total. The most serious of the rest:
- CVE-2026-15723 (CVSS 8.2): when OmniAuth SAML and LDAP auto-linking are both enabled, an authenticated user could take over an existing LDAP-backed account without any interaction from its owner, due to improper input sanitization in the LDAP email lookup.
- CVE-2026-112212 (CVSS 7.5): an unauthenticated user could, under certain conditions, poison a shared cache's OAuth/OIDC discovery document to redirect certain flows to an externally controlled server. GitLab's Peter Arts found it internally.
- CVE-2026-12664 (CVSS 6.8): a token scoped to read_api could retrieve a project's incoming email address and create work items, bypassing the token's restrictions.
- CVE-2026-16255 (CVSS 5.9): incomplete enforcement of the instance-wide SAML or LDAP membership lock in Enterprise Edition let users grant or accept memberships outside the identity provider's control.
The other eight issues score between 2.7 and 4.3. They include a flaw GitLab says could expose sensitive internal server credentials through improperly filtered response headers (CVE-2026-105777), milestone metadata leaking from private projects through the group milestones API (CVE-2026-13319), and paid AI features reachable without a valid subscription (CVE-2026-112378).
Upgrade to 19.5.1 or your branch's patch release
GitLab recommends that every self-managed installation upgrade immediately to 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 or 18.11.13. GitLab lists no fix for branches older than 18.11, so instances there need to move to a patched branch to close the critical flaw. Deploying GitLab's two detections while the upgrade is scheduled gives some visibility in the meantime.
The last perfect-10 did not stay theoretical for long: Rapid7 published a working exploit for it within days, as we reported in Rapid7 turns GitLab's perfect-10 bug into working exploit. Administrators who waited on that one should not wait on this one.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.