GitLab CE/EE Flaws Allow Server Code Execution

What happened

GitLab has addressed security flaws in GitLab CE/EE that could let attackers run code on a server, take over an account, or redirect certain sign-in flows under specific conditions. Think of a shared office building: these weaknesses affect different entrances and services, so repairing one does not necessarily repair the others. The most highly rated issue, CVE-2026-110264, could allow someone without a GitLab login to execute code on the GitLab server.

The vendor advisory covers flaws with different prerequisites and different fixed releases. CVE-2026-110264 concerns the processing of a specially crafted regular expression, a pattern used to match text. CVE-2026-89078 and CVE-2026-93577 also involve regular expressions, but require an authenticated user and involve CI/CD configuration. The remaining issues concern cached sign-in information and account linking.

NVD published entries for CVE-2026-110264, CVE-2026-112212, and CVE-2026-15723 on 2026-10-22; its entries for CVE-2026-89078 and CVE-2026-93577 were published on 2026-09-24. KISA, Korea's Internet & Security Agency, also published an advisory on 2026-10-22. At the time of the CISA Known Exploited Vulnerabilities catalog check, none of these CVEs was listed.

Technical details

CVE-2026-110264 is classified as CWE-190, Integer Overflow or Wraparound. An integer overflow occurs when a calculation exceeds the range a numeric value can hold. Here, the problem arises while GitLab compiles a specially crafted regular expression into a form it can process. Under certain conditions, an unauthenticated attacker could use the flaw to execute arbitrary code, meaning attacker-chosen instructions, on the GitLab server. NVD assigns it a CVSS 3.1 score of 10.0 and CRITICAL severity. CVSS is a standardized measure of vulnerability severity; the score does not establish whether exploitation has occurred.

CVE-2026-93577 also carries the CWE-190 classification. CVE-2026-89078 is classified as CWE-415, Double Free, a memory-management error in which software releases the same memory more than once. Both concern specially crafted regular expressions in continuous integration and continuous delivery, or CI/CD, configuration. CVE-2026-93577 involves compilation, while CVE-2026-89078 involves parsing. Each requires an authenticated user and could permit server code execution under certain conditions. Both have CVSS 3.1 scores of 9.9 and CRITICAL severity. Their shared subject matter does not make them interchangeable with CVE-2026-110264: their authentication requirements and fixed releases differ.

CVE-2026-112212 concerns an OAuth/OIDC discovery document, which supplies endpoint addresses used in sign-in flows. GitLab improperly trusted user-supplied values when building addresses in cached discovery responses. Under certain conditions, someone without a login could alter a shared cached document so that certain flows went to an externally controlled server. NVD classifies the weakness as CWE-444, Inconsistent Interpretation of HTTP Requests, also called HTTP request/response smuggling, and assigns a CVSS 3.1 score of 7.5 with HIGH severity. The described consequence is redirection of certain flows; it should not be expanded into an unsupported claim about what an attacker could subsequently obtain.

CVE-2026-15723 is classified as CWE-90, Improper Neutralization of Special Elements used in an LDAP Query, commonly called LDAP injection. LDAP is a protocol used to query directory services, including directories containing account information. When OmniAuth SAML and LDAP auto-linking were both enabled, insufficient input sanitization in the email lookup used for identity linking could allow an authenticated user to take over an existing LDAP-backed account. The targeted user would not need to interact with the attacker. NVD assigns this issue a CVSS 3.1 score of 8.2 and HIGH severity. This configuration requirement matters when assessing exposure, alongside the installed GitLab release.

Who is affected

Everyday users

For everyday GitLab users, the relevant risks include the security of the server hosting their work and the integrity of account access. The account-linking flaw could affect an existing LDAP-backed account when the required configuration is enabled. The discovery-document flaw could redirect certain sign-in flows under the conditions described in the advisory. Neither description establishes that a particular account has been affected.

Updating a browser or changing a local development tool does not apply these server fixes. If someone else manages your GitLab service, ask the administrator to confirm the installed release and whether the advisory's fixes have been applied. Users whose accounts come from an organizational directory should also have the administrator assess the account-linking configuration.

Developers

Developers should pay particular attention to the distinction between regular expressions in application code and the vulnerable handling described here. CVE-2026-89078 and CVE-2026-93577 concern specially crafted expressions in GitLab CI/CD configuration. Their stated impact is code execution on the GitLab server under certain conditions, rather than simply an unsuccessful pipeline. An authenticated-user requirement is part of both descriptions.

A release that fixed those CI/CD issues may still need an additional update for CVE-2026-110264. For example, 19.3.3 addresses CVE-2026-89078 and CVE-2026-93577, while the listed fix for CVE-2026-110264 on that branch is 19.3.6. Coordinate with the GitLab administrator instead of treating an earlier security update as coverage for every issue in this advisory.

Server and IT admins

Server and IT administrators need to match each installed release to each applicable affected range. CVE-2026-110264 includes releases starting at 7.0, CVE-2026-15723 includes releases starting at 10.1, and CVE-2026-112212 includes releases starting at 18.3. The earlier fixes for CVE-2026-89078 and CVE-2026-93577 cover affected releases on the 19.2, 19.3, and 19.4 branches.

The listed 18.11.13, 19.0.10, 19.1.9, and 19.2.9 fixes for CVE-2026-110264 do not establish that those releases address every other CVE here. The affected ranges for CVE-2026-15723 and CVE-2026-112212 extend to 19.3.6. Select an update destination by checking all applicable rows, then follow the update steps in the vendor's advisory.

What to do now

1. Identify the GitLab CE/EE release running on each instance you manage. For a Linux package installation, use the environment-information command below to help establish the installed version.
2. Check CVE-2026-110264 against its branch-specific ranges: >= 7.0 and < 18.11.13; >= 19.0 and < 19.0.10; >= 19.1 and < 19.1.9; >= 19.2 and < 19.2.9; >= 19.3 and < 19.3.6; >= 19.4 and < 19.4.3; and >= 19.5 and < 19.5.1. The corresponding fixed releases are 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3, and 19.5.1, with later releases covered as specified in the advisory.
3. Check both CVE-2026-89078 and CVE-2026-93577 against their shared ranges: >= 19.2 and < 19.2.7; >= 19.3 and < 19.3.3; and >= 19.4 and < 19.4.1. Their corresponding fixes are 19.2.7, 19.3.3, and 19.4.1 and later. Continue checking the other CVEs even if these fixes are already installed.
4. Check CVE-2026-15723 against >= 10.1 and < 19.3.6, and CVE-2026-112212 against >= 18.3 and < 19.3.6. Both also affect >= 19.4 and < 19.4.3 and >= 19.5 and < 19.5.1. Their corresponding fixed releases are 19.3.6, 19.4.3, and 19.5.1 and later. For the account-takeover issue, determine whether OmniAuth SAML and LDAP auto-linking are both enabled.
5. Choose a destination release that addresses every applicable issue, then follow the update steps in the vendor's advisory. On the listed 19.3, 19.4, and 19.5 branches, the respective fixed releases 19.3.6, 19.4.3, and 19.5.1 cover all the applicable issues described here.
6. After updating, confirm the running version and check normal sign-in, account linking where used, and CI/CD operation. Keep the installed release and the advisory's applicable fixed releases together in your maintenance record so coverage is clear.

sudo gitlab-rake gitlab:env:info

If you can't update yet

• If an update must wait, check the vendor advisory for guidance on restricting access to the affected GitLab instance and reducing its internet exposure. These measures do not establish that the underlying flaws are fixed.
• Check the vendor advisory for any recommendation to disable an affected feature temporarily. The account-linking flaw requires both OmniAuth SAML and LDAP auto-linking, but that prerequisite alone is not a vendor instruction to change those features.

How to confirm the fix

• Confirm the version actually running after maintenance, using the listed environment-information command where applicable. Compare that result with every applicable affected range.
• Verify that earlier fixes have not been mistaken for complete coverage: 19.2.7, 19.3.3, and 19.4.1 address CVE-2026-89078 and CVE-2026-93577, but are below the corresponding fixes for CVE-2026-110264.
• For CVE-2026-15723 and CVE-2026-112212, confirm that the selected release meets the applicable 19.3.6, 19.4.3, or 19.5.1 fix threshold. Check the account-linking prerequisites separately when documenting exposure to CVE-2026-15723.
• Confirm that expected sign-in and CI/CD workflows still function after the update. Successful functional checks establish that those workflows operate; use the installed release and advisory comparison to confirm patch coverage.

NVD scores and CISA KEV status

As of October 30, 2026, none of these CVEs is listed in the CISA Known Exploited Vulnerabilities catalog.

Affected products and fixed versions 19 rows

The vendor's advisory is the authority on affected and fixed versions. If a cell says “See the vendor advisory”, check it there.

Frequently asked questions

References

• GitLab advisory: https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/
• GitLab advisory: https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-1-released/
• NVD: CVE-2026-110264
• NVD: CVE-2026-112212
• NVD: CVE-2026-15723
• NVD: CVE-2026-89078
• NVD: CVE-2026-93577
• CISA Known Exploited Vulnerabilities catalog
• Also reported by KISA (Korea Internet & Security Agency) on October 22, 2026: KISA advisory (Korean)

How this page is made: versions and CVE IDs come from the vendor advisory table; CVSS scores and weakness types from NVD; exploitation status only from CISA KEV. The explainer is written with AI from those facts and published only after an automated check matches every version, CVE, score and command against the sources. Commands are limited to ones in official documentation. Always follow the vendor's advisory. Read in Korean.