--- title: "GitLab CVE-2026-110264: CVSS 10.0 RCE and the Patch Record" description: "CVE-2026-110264 is a 10.0 Critical GitLab flaw that lets an unauthenticated user run code on the server. Patch to a fixed release and keep the evidence." url: https://policycortex.com/blog/gitlab-cve-2026-110264-rce-governance sealed: 2026-10-22 register: blog/gitlab-cve-2026-110264-rce-governance records: 3 digest: sha3:45e1bb099fbafa790c7f290dfe015d1cd4d8601dd07381e55027341dc142481d --- # GitLab Critical Flaw: Unauthenticated Code Execution on the Server Resources / Blog CVE-2026-110264 scores 10.0 Critical and lets an unauthenticated user run code on a GitLab server. The fix is a patch release. Leonard Esere · Sealed 2026-10-22 · Reading time 5 min Filed under: [GitLab](https://policycortex.com/blog/tags/gitlab), [CVE-2026-110264](https://policycortex.com/blog/tags/cve-2026-110264), [remote code execution](https://policycortex.com/blog/tags/remote-code-execution), [flaw remediation](https://policycortex.com/blog/tags/flaw-remediation), [NIST 800-53](https://policycortex.com/blog/tags/nist-800-53) **Summary** - CVE-2026-110264 scores 10.0 Critical. An unauthenticated user could run arbitrary code on the GitLab server. - The flaw is an integer overflow in the GitLab Regular Expression Compiler. - Affected versions run from 7.0 up to each fixed release in the record. - A code host holds source code and pipeline secrets. Its patch record is governance evidence. ## No login was needed GitLab hosts source code for many teams. A flaw there puts code and pipeline secrets at risk. The Common Vulnerabilities and Exposures record for [CVE-2026-110264](https://www.cve.org/CVERecord?id=CVE-2026-110264) describes a remote code execution (RCE) flaw. The Common Vulnerability Scoring System (CVSS) score is 10.0, Critical. That is the highest score on the scale. Under certain conditions, an unauthenticated user could run arbitrary code. The code would run on the GitLab server itself. ## Where the flaw lives The flaw is an integer overflow. It happens when GitLab compiles a specially crafted regular expression. GitLab calls that component the Regular Expression Compiler. A regular expression is a pattern used to match text. The crafted pattern pushed a value past its limit. The record credits the researcher joaxcar for the report. GitLab received it through the HackerOne bug bounty program. ## Which systems are affected The flaw affects GitLab Community Edition (CE). It also affects GitLab Enterprise Edition (EE). Affected versions start at 7.0, before 18.11.13. The 19.0 line is affected before 19.0.10. The 19.1 line is affected before 19.1.9. The 19.2 line is affected before 19.2.9. The 19.3 line is affected before 19.3.6. The 19.4 line is affected before 19.4.3. The 19.5 line is affected before 19.5.1. GitLab released the fixed versions on October 21, 2026. The fixed versions are 19.5.1 and 19.4.3. The list continues with 19.3.6 and 19.2.9. It ends with 19.1.9, 19.0.10, and 18.11.13. GitLab says GitLab.com already runs the patched version. Self managed installs still need the upgrade. ## The governance lesson A code host is not a side system. It holds source code, build settings, and tokens. Those tokens often reach cloud accounts and production systems. So the patch record for a code host matters. Record the version before the patch. Record the fixed version after the patch. Record the date and the person who verified it. Continuous monitoring should name the code host by name. A scan list that skips development tools has a gap. This flaw is exactly the kind that gap hides. PolicyCortex does not patch GitLab or clean hosts. PolicyCortex collects patch and configuration evidence from live systems. That evidence is what an auditor or assessor asks for. ## What to do this week Find every self managed GitLab install you run. Check its version against the affected ranges above. Upgrade each install to its fixed version. Then verify the new version in the running system. Save the version output with the patch date. Keep the record with your other flaw remediation evidence. ## Sources - [CVE-2026-110264](https://www.cve.org/CVERecord?id=CVE-2026-110264) record, CVE Program. Updated October 22, 2026. - GitLab patch release for 19.5.1, GitLab. https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/ - Original diagram by PolicyCortex. ## Next step Want code host patch evidence collected on a schedule, not by spreadsheet? See how [PolicyCortex](https://policycortex.com) reads it from the live tenant. **Questions on this record** **Q: What is CVE-2026-110264?** A: An integer overflow flaw in the GitLab Regular Expression Compiler. It is rated 10.0 Critical. **Q: Which versions fix it?** A: GitLab released 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13 on October 21, 2026. **Q: Does PolicyCortex patch GitLab?** A: No. PolicyCortex does not patch GitLab or clean hosts. It collects patch evidence from live systems. ## Related records Guides and articles describe the work. The evidence that work produces is described in three proof pages and one architecture page. - **proof.state**: [Proof of State](https://policycortex.com/proof/state). What the environment was, as of a date someone else picks: point-in-time records, content hashed and chained. - **proof.change**: [Proof of Change](https://policycortex.com/proof/change). Who or what altered the environment, under what authority, with before and after state hashes. - **proof.agency**: [Proof of Agency](https://policycortex.com/proof/agency). What a machine was permitted to do before it acted, what it did, and what would have stopped it. - **architecture**: [Architecture](https://policycortex.com/architecture). How the chain is built and where it lives: inside your tenant, with no egress of evidence. ### Further reading in this register | Published | Entry | Reading | |---|---|---| | 2026-10-22 | [Arista VeloCloud Orchestrator Zero-Day: A Signed-In User Becomes Superuser](https://policycortex.com/blog/arista-vco-zero-day-superuser-escalation): Arista confirms active exploitation of the on-premises VeloCloud Orchestrator flaw. A signed-in user can reach superuser rights through SQL injection. | 5 min | | 2026-10-22 | [Four Exploited Flaws Hit the Firewall, the Mail Gateway, and the Backup Server](https://policycortex.com/blog/kev-edge-appliances-palo-alto-cisco-ahsay): CISA added four exploited flaws on October 14, 2026. They hit a Palo Alto Networks firewall, a Cisco email gateway, and an Ahsay backup server. | 5 min | | 2026-10-22 | [PwnEscape: The Linux Kernel Flaw That Escapes the Virtual Machine](https://policycortex.com/blog/pwnescape-linux-kernel-guest-host-escape): CVE-2026-99999 scores 9.3 Critical and lets a guest VM read host memory, crash the host, and run code as root. The fix is a host kernel update. Guest patches do not help. | 5 min | Verify the record this entry describes. [Request Access](https://app.policycortex.com/auth?mode=request-access) · [Book a call](https://policycortex.com/book) Dates of record - **Published**: 2026-10-22 - **Last updated**: Unchanged since sealing - **Author**: Leonard Esere - **Record**: https://policycortex.com/blog/gitlab-cve-2026-110264-rce-governance ## Register colophon | Seq | Label | SHA3-256 | Prev | |---|---|---|---| | REC 0000 | HEAD | 05898a9e0dfb | b025b746a83e | | REC 0001 | BODY | 58ac22d163ee | 05898a9e0dfb | | REC 0002 | RELATED RECORDS | 45e1bb099fba | 58ac22d163ee | Head sha3:45e1bb099fbafa790c7f290dfe015d1cd4d8601dd07381e55027341dc142481d. Each digest is SHA3-256 over the previous digest, the register key, the record label, and the record copy; a second party can recompute it from this document.