{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T18:10:31.291Z",
  "tag": {
    "id": "gitlab",
    "label": "GitLab",
    "isStack": false,
    "url": "https://pwn.watch/t/gitlab",
    "feed": "https://pwn.watch/t/gitlab/feed.xml"
  },
  "counts": {
    "incidents": 4,
    "live": 1,
    "notFullyPatched": 0,
    "patched": 4
  },
  "incidents": [
    {
      "slug": "gitlab-cve-2026-110264-regex-rce",
      "title": "GitLab CVSS 10 unauthenticated RCE via regex compiler (CVE-2026-110264)",
      "url": "https://pwn.watch/i/gitlab-cve-2026-110264-regex-rce",
      "json": "https://pwn.watch/i/gitlab-cve-2026-110264-regex-rce.json",
      "status": "live",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "GitLab CE/EE (self-managed)",
      "tags": [
        "devtools",
        "gitlab",
        "rce"
      ],
      "cveIds": [
        "CVE-2026-110264"
      ],
      "affectedVersions": [
        "All versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, 19.5 before 19.5.1"
      ],
      "fixedVersions": [
        "19.5.1",
        "19.4.3",
        "19.3.6",
        "19.2.9",
        "19.1.9",
        "19.0.10",
        "18.11.13"
      ],
      "startedAt": "2026-10-21",
      "closedAt": null,
      "updatedAt": "2026-10-22T16:00:44+02:00",
      "summary": "GitLab released a critical patch on Oct 21 2026 for CVE-2026-110264: an integer overflow in the bundled Onigmo / regex compiler that can allow an unauthenticated attacker to execute code on self-managed GitLab. CVSS 10.0; every CE/EE version from 7.0 (2014) is in range. Instances that only applied the Oct 12 regex fix remain vulnerable and must upgrade again.",
      "xPost": null
    },
    {
      "slug": "gitlab-community-edition-and-enterprise-edition-cve-2026-85706",
      "title": "GitLab Community Edition and Enterprise Edition: GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability",
      "url": "https://pwn.watch/i/gitlab-community-edition-and-enterprise-edition-cve-2026-85706",
      "json": "https://pwn.watch/i/gitlab-community-edition-and-enterprise-edition-cve-2026-85706.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "GitLab Community Edition and Enterprise Edition",
      "tags": [
        "devtools",
        "gitlab",
        "cisa-kev",
        "auth-bypass"
      ],
      "cveIds": [
        "CVE-2026-85706"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-09-11",
      "closedAt": "2026-09-11",
      "updatedAt": "2026-09-11",
      "summary": "GitLab Community Edition and Enterprise Edition contains a path traversal vulnerability that allows an unauthenticated user to read arbitrary files due to an improper path confinement and missing authentication enforcement in the repository commits API. Added to CISA KEV on 2026-09-11.",
      "xPost": null
    },
    {
      "slug": "red-hat-consulting-gitlab-breach-october-2025",
      "title": "Red Hat Consulting GitLab breached: ~800 customer engagement reports stolen",
      "url": "https://pwn.watch/i/red-hat-consulting-gitlab-breach-october-2025",
      "json": "https://pwn.watch/i/red-hat-consulting-gitlab-breach-october-2025.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "no-fix-needed",
      "product": "Red Hat Consulting self-managed GitLab",
      "tags": [
        "devtools",
        "red-hat",
        "gitlab",
        "crimson-collective",
        "shinyhunters",
        "data-breach",
        "extortion"
      ],
      "cveIds": [],
      "affectedVersions": [
        "n/a"
      ],
      "fixedVersions": [],
      "startedAt": "2025-10-01",
      "closedAt": "2025-10-10",
      "updatedAt": "2025-10-10",
      "summary": "The Crimson Collective broke into a self-managed GitLab instance used by Red Hat Consulting and claimed about 570 GB from 28,000 repos, including roughly 800 Customer Engagement Reports with infrastructure, config and credential details. Red Hat confirmed the access and said its products, supply chain and hosted services were not affected. ShinyHunters later joined the extortion.",
      "xPost": null
    },
    {
      "slug": "gitlab-ce-ee-cve-2023-7028",
      "title": "GitLab Community and Enterprise Editions Improper Access Control",
      "url": "https://pwn.watch/i/gitlab-ce-ee-cve-2023-7028",
      "json": "https://pwn.watch/i/gitlab-ce-ee-cve-2023-7028.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "GitLab CE/EE",
      "tags": [
        "devtools",
        "ruby",
        "gitlab",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2023-7028"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-01-12",
      "closedAt": "2024-05-01",
      "updatedAt": "2024-05-01",
      "summary": "GitLab Community and Enterprise Editions contain an improper access control vulnerability. This allows an attacker to trigger password reset emails to be sent to an unverified email address to ultimately facilitate an account takeover. Added to the CISA KEV catalog on 2024-05-01. CVE-2023-7028 was assigned before 2024; the KEV listing came in 2024.",
      "xPost": null
    }
  ],
  "posts": [
    {
      "authorName": "Kenji",
      "handle": "inagakikenji",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1055736419061100545/e1Tz89g__bigger.jpg",
      "text": "米GitLabは10月21日（現地時間）、開発プラットフォーム「GitLab」に深刻（Critical）な脆弱性（CVE-2026-110264）が見つかったと発表し、修正版を公開した。CVSSスコアは最大の「10.0」。特定の条件下で、認証されていないユーザーがGitLabサーバ上で任意のコードを実行できる可能性がある… https://t.co/9RBiQlMg8N",
      "date": "2026-10-22T03:44:09.000Z",
      "url": "https://x.com/inagakikenji/status/2113114155519758377",
      "media": [],
      "incident": "gitlab-cve-2026-110264-regex-rce"
    },
    {
      "authorName": "flowers.engg",
      "handle": "flowersengg",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2067629049481195520/xxkejAlq_bigger.jpg",
      "text": "patched self-managed GitLab on 12 Oct? patch again.\n\nthat release fixed a CVSS 10 regex RCE at 19.4.2. yesterday's CVE-2026-110264 is another CVSS 10 in the regex compiler, and 19.4.2 is still in range.\n\nfixed: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13",
      "date": "2026-10-21T23:57:03.000Z",
      "url": "https://x.com/flowersengg/status/2113057007309885672",
      "media": [],
      "incident": "gitlab-cve-2026-110264-regex-rce"
    },
    {
      "authorName": "Iván Pérez",
      "handle": "IvanPerezF_",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2100615087392215040/4ad0g2S8_bigger.jpg",
      "text": "Si parcheaste tu GitLab hace 9 días y te quedaste tranquilo, tengo malas noticias: vuelves a estar expuesto.\n\nGitLab ha corregido hoy el CVE-2026-110264, puntuado con un 10 sobre 10 en CVSS. Permite ejecutar código en el servidor sin iniciar sesión.\n\nAfecta a todas las versiones",
      "date": "2026-10-21T20:26:51.000Z",
      "url": "https://x.com/IvanPerezF_/status/2113004107149512943",
      "media": [],
      "incident": "gitlab-cve-2026-110264-regex-rce"
    }
  ],
  "changes": [
    {
      "incident": "gitlab-cve-2026-110264-regex-rce",
      "incidentTitle": "GitLab CVSS 10 unauthenticated RCE via regex compiler (CVE-2026-110264)",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-22",
      "title": "Shadowserver tracks 2,700+ internet-exposed GitLab CE instances (honeypot and patch status unknown); researcher joaxcar reported the bug via HackerOne.",
      "body": null,
      "sourceUrl": "https://www.bleepingcomputer.com/news/security/gitlab-warns-of-new-max-severity-code-execution-vulnerability/",
      "url": "https://pwn.watch/i/gitlab-cve-2026-110264-regex-rce"
    },
    {
      "incident": "gitlab-cve-2026-110264-regex-rce",
      "incidentTitle": "GitLab CVSS 10 unauthenticated RCE via regex compiler (CVE-2026-110264)",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-21",
      "title": "GitLab released 19.5.1 and backports for CVE-2026-110264; GitLab.com already patched.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/gitlab-cve-2026-110264-regex-rce"
    },
    {
      "incident": "gitlab-cve-2026-110264-regex-rce",
      "incidentTitle": "GitLab CVSS 10 unauthenticated RCE via regex compiler (CVE-2026-110264)",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-12",
      "title": "Prior critical regex patch released (separate CVE); some operators stopped there.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/gitlab-cve-2026-110264-regex-rce"
    },
    {
      "incident": "gitlab-community-edition-and-enterprise-edition-cve-2026-85706",
      "incidentTitle": "GitLab Community Edition and Enterprise Edition: GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-09-11",
      "title": "CISA added CVE-2026-85706 to the KEV catalog (due 2026-09-14).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/gitlab-community-edition-and-enterprise-edition-cve-2026-85706"
    },
    {
      "incident": "red-hat-consulting-gitlab-breach-october-2025",
      "incidentTitle": "Red Hat Consulting GitLab breached: ~800 customer engagement reports stolen",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2025-10-10",
      "title": "FINRA alert to member firms",
      "body": null,
      "sourceUrl": "https://www.finra.org/rules-guidance/guidance/red-hat-security-incident-20251010",
      "url": "https://pwn.watch/i/red-hat-consulting-gitlab-breach-october-2025"
    },
    {
      "incident": "red-hat-consulting-gitlab-breach-october-2025",
      "incidentTitle": "Red Hat Consulting GitLab breached: ~800 customer engagement reports stolen",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2025-10-02",
      "title": "Red Hat confirms the incident",
      "body": null,
      "sourceUrl": "https://www.redhat.com/en/blog/security-update-incident-related-red-hat-consulting-gitlab-instance",
      "url": "https://pwn.watch/i/red-hat-consulting-gitlab-breach-october-2025"
    },
    {
      "incident": "red-hat-consulting-gitlab-breach-october-2025",
      "incidentTitle": "Red Hat Consulting GitLab breached: ~800 customer engagement reports stolen",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2025-10-01",
      "title": "Crimson Collective claims the Red Hat GitLab theft",
      "body": null,
      "sourceUrl": "https://www.bleepingcomputer.com/news/security/red-hat-confirms-security-incident-after-hackers-breach-gitlab-instance/",
      "url": "https://pwn.watch/i/red-hat-consulting-gitlab-breach-october-2025"
    },
    {
      "incident": "gitlab-ce-ee-cve-2023-7028",
      "incidentTitle": "GitLab Community and Enterprise Editions Improper Access Control",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-05-01",
      "title": "CISA added CVE-2023-7028 to the KEV catalog (federal deadline 2024-05-22)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/gitlab-ce-ee-cve-2023-7028"
    },
    {
      "incident": "gitlab-ce-ee-cve-2023-7028",
      "incidentTitle": "GitLab Community and Enterprise Editions Improper Access Control",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-01-12",
      "title": "CVE-2023-7028 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2023-7028",
      "url": "https://pwn.watch/i/gitlab-ce-ee-cve-2023-7028"
    }
  ]
}