GitLab released a critical security update that remediates a vulnerability, with the identifier CVE-2026-110264, that allowed an unauthenticated attacker to execute arbitrary code on a vulnerable self-managed GitLab server.

Through our blog, we will understand what the critical vulnerability in GitLab is about, the threat it poses if not remediated, and what organizations need to do.

About the vulnerability

Name of the vulnerability: Critical GitLab RCE vulnerability 

About: The vulnerability is caused due to integer overflow in the regular expression engine.

An attacker can send a specially designed text pattern to trigger the calculation error and run arbitrary code on the server without having to log in.  

The patch release also addresses other security issues, including:

• CVE-2026-15723 (CVSS 8.2): An account-takeover vulnerability when both SAML OmniAuth and LDAP auto-linking are enabled.
• CVE-2026-112212 (CVSS 7.5): A cache-poisoning vulnerability affecting OAuth/OIDC discovery endpoints under certain conditions.
• CVE-2026-12664 (CVSS 6.8): An access-control issue involving a GraphQL work item email-address field.

What could an attacker do with the vulnerability?

An attacker can exploit the vulnerability to:

• Execute arbitrary code remotely on an affected server.
• Cause a complete compromise of the GitLab application environment.
• Gain unauthorized access to repositories and data accessible to the compromised server.
• Gain access to CI/CD variables, secrets, and credentials available in an instance.
• Further malicious activity using the privileges of a compromised service.

SharkStriker’s recommendations

• Prioritize CVE-2026-110264 because of its critical severity and unauthenticated remote code-execution potential.
• Identify all self-managed GitLab instances, including older release branches.
• Upgrade to the applicable fixed version listed above.
• Review GitLab application logs using the detection rules published by GitLab.
• Investigate suspicious server activity and unexpected changes to repositories or CI/CD configurations.
• If compromise is suspected, assess potential exposure of CI/CD variables, access tokens, and other credentials, and rotate affected secrets as appropriate.
• Plan maintenance windows for upgrades involving database migrations.

SharkStriker’s Actions:

• Vulnerability intelligence validated against the official GitLab patch release.
• Critical RCE and additional security fixes reviewed for remediation prioritization.
• Detection engineering recommended to assess coverage for GitLab application errors and suspicious server-side activity.
• Threat hunting recommended for potentially affected self-managed installations.