pwn.watch: GitLab incident updates

[critical] GitLab CVSS 10 unauthenticated RCE via regex compiler (CVE-2026-110264)

Thu, 22 Oct 2026 20:41:14 GMT

GitLab released a critical patch on Oct 21 2026 for CVE-2026-110264: an integer overflow in the bundled Onigmo / regex compiler that can allow an unauthenticated attacker to execute code on self-managed GitLab. CVSS 10.0; every CE/EE version from 7.0 (2014) is in range. Instances that only applied the Oct 12 regex fix remain vulnerable and must upgrade again.

Status: live · Patch: patched · Fixed in: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13

Latest updates:

2026-10-22: Shadowserver tracks 2,700+ internet-exposed GitLab CE instances (honeypot and patch status unknown); researcher joaxcar reported the bug via HackerOne. (source)
2026-10-22: GitLab updated its advisory with two threat detections ("Onigmo native worker crash" and "Org mode render error burst") to help self-managed customers spot exploitation attempts; GitLab.com and Dedicated remain patched. (source)
2026-10-21: GitLab released 19.5.1 and backports for CVE-2026-110264; GitLab.com already patched.

CVEs: CVE-2026-110264

[high] GitLab Community Edition and Enterprise Edition: GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability

Fri, 11 Sep 2026 00:00:00 GMT

GitLab Community Edition and Enterprise Edition contains a path traversal vulnerability that allows an unauthenticated user to read arbitrary files due to an improper path confinement and missing authentication enforcement in the repository commits API. Added to CISA KEV on 2026-09-11.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-09-11: CISA added CVE-2026-85706 to the KEV catalog (due 2026-09-14).

CVEs: CVE-2026-85706

[high] Red Hat Consulting GitLab breached: ~800 customer engagement reports stolen

Fri, 10 Oct 2025 00:00:00 GMT

The Crimson Collective broke into a self-managed GitLab instance used by Red Hat Consulting and claimed about 570 GB from 28,000 repos, including roughly 800 Customer Engagement Reports with infrastructure, config and credential details. Red Hat confirmed the access and said its products, supply chain and hosted services were not affected. ShinyHunters later joined the extortion.

Status: closed · Patch: no-fix-needed

Latest updates:

2025-10-10: FINRA alert to member firms (source)
2025-10-02: Red Hat confirms the incident (source)
2025-10-01: Crimson Collective claims the Red Hat GitLab theft (source)

[critical] GitLab Community and Enterprise Editions Improper Access Control

Wed, 01 May 2024 00:00:00 GMT

GitLab Community and Enterprise Editions contain an improper access control vulnerability. This allows an attacker to trigger password reset emails to be sent to an unverified email address to ultimately facilitate an account takeover. Added to the CISA KEV catalog on 2024-05-01. CVE-2023-7028 was assigned before 2024; the KEV listing came in 2024.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-05-01: CISA added CVE-2023-7028 to the KEV catalog (federal deadline 2024-05-22) (source)
2024-01-12: CVE-2023-7028 published (source)

CVEs: CVE-2023-7028