Kenji
@inagakikenji
米GitLabは10月21日（現地時間）、開発プラットフォーム「GitLab」に深刻（Critical）な脆弱性（CVE-2026-110264）が見つかったと発表し、修正版を公開した。CVSSスコアは最大の「10.0」。特定の条件下で、認証されていないユーザーがGitLabサーバ上で任意のコードを実行できる可能性がある… t.co/9RBiQlMg8N
GitLab
Security incidents tagged GitLab. Newest first.
- Incidents
- 4
- Live
- 1
- Patched
- 4
- Days without an incident
- 1
- Longest quiet run: 517 days (May 2–Sep 30)
- LiveCriticalPatched
GitLab CVSS 10 unauthenticated RCE via regex compiler (CVE-2026-110264)
GitLab released a critical patch on Oct 21 2026 for CVE-2026-110264: an integer overflow in the bundled Onigmo / regex compiler that can allow an unauthenticated attacker to execute code on self-managed GitLab. CVSS 10.0; every CE/EE version from 7.0 (2014) is in range. Instances that only applied the Oct 12 regex fix remain vulnerable and must upgrade again.
GitLab CE/EE (self-managed)Since Oct 21, 2026
Show 3 older incidents3 older incidents
September 2026 1
HighGitLab Community Edition and Enterprise Edition: GitLab Community Edition and Enterprise Edition Path Traversal VulnerabilityPatched
GitLab Community Edition and Enterprise Edition Patched
GitLab Community Edition and Enterprise Edition contains a path traversal vulnerability that allows an unauthenticated user to read arbitrary files due to an improper path confinement and missing authentication enforcement in the repository commits API. Added to CISA KEV on 2026-09-11.
Open incident →CVE-2026-85706
October 2025 1
HighRed Hat Consulting GitLab breached: ~800 customer engagement reports stolenNo fix needed
Red Hat Consulting self-managed GitLab No fix needed
The Crimson Collective broke into a self-managed GitLab instance used by Red Hat Consulting and claimed about 570 GB from 28,000 repos, including roughly 800 Customer Engagement Reports with infrastructure, config and credential details. Red Hat confirmed the access and said its products, supply chain and hosted services were not affected. ShinyHunters later joined the extortion.
January 2024 1
CriticalGitLab Community and Enterprise Editions Improper Access ControlPatched
GitLab CE/EE Patched
GitLab Community and Enterprise Editions contain an improper access control vulnerability. This allows an attacker to trigger password reset emails to be sent to an unverified email address to ultimately facilitate an account takeover. Added to the CISA KEV catalog on 2024-05-01. CVE-2023-7028 was assigned before 2024; the KEV listing came in 2024.
Open incident →CVE-2023-7028
2 GitLab incidents in the last 12 months
Critical 4 · High 3 · Med 2 · Low 1 · Update ½Severity-weighted: critical 4 · high 3 · medium 2 · low 1 · update ½LessMore
Posts 3
- GitLab CVSS 10 unauthenticated RCE via regex compiler (CVE-2026-110264)
- GitLab CVSS 10 unauthenticated RCE via regex compiler (CVE-2026-110264)
flowers.engg@flowersenggpatched self-managed GitLab on 12 Oct? patch again. that release fixed a CVSS 10 regex RCE at 19.4.2. yesterday's CVE-2026-110264 is another CVSS 10 in the regex compiler, and 19.4.2 is still in range. fixed: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13
- GitLab CVSS 10 unauthenticated RCE via regex compiler (CVE-2026-110264)
Iván Pérez@IvanPerezF_Si parcheaste tu GitLab hace 9 días y te quedaste tranquilo, tengo malas noticias: vuelves a estar expuesto. GitLab ha corregido hoy el CVE-2026-110264, puntuado con un 10 sobre 10 en CVSS. Permite ejecutar código en el servidor sin iniciar sesión. Afecta a todas las versiones
