GitLab patches a critical flaw that lets unauthenticated attackers run code on self-managed servers, affecting every release since 7.0 in 2014

If you manage your own GitLab server, you must upgrade immediately to prevent unauthenticated code execution on your systems.

GitLab has released an urgent patch for a critical security vulnerability (CVSS 10.0) that allows unauthenticated attackers to execute arbitrary code on self-managed servers. The flaw, tracked as CVE-2026-110264, impacts all GitLab releases since version 7.0 in 2014. GitLab attributes the vulnerability to an integer overflow in the Onigmo regular-expression compiler, which is integrated into their software. The company is addressing the issue across seven different versions, backporting fixes to older releases beyond their standard patching policy due to the severity. GitLab has not reported any instances of the vulnerability being exploited in the wild, and while GitLab.com and GitLab Dedicated tenants are unaffected, administrators of self-managed GitLab instances must apply the update. To aid in detection, GitLab has also provided two detection rules for log analysis. This is the fourth code-execution flaw related to GitLab's regular-expression engine reported by the same researcher in recent weeks.

This widespread vulnerability underscores the deep reliance on third-party libraries, like Onigmo, within critical software infrastructure and the cascading effect when these foundational components have flaws. The fact that GitLab had to backport fixes to versions as old as 2014 highlights the challenge of maintaining security across long-lived, widely deployed self-managed software and the potential for new, critical issues to emerge in previously stable code. It suggests a need for more robust supply chain security practices and continuous auditing of embedded libraries, even in mature projects.

The immediate concern for administrators is the significant effort required to patch, especially given the extended range of affected versions and the potential for downtime during database upgrades on single-node installations. This event also raises questions about the security posture of other software relying on the same vulnerable Onigmo engine and may prompt a broader industry review of how such dependencies are managed and secured. Future updates and research will likely focus on more advanced detection methods and potentially alternative regular expression engines.