GitLab CE/EE: security advisory

GitLab CE/EE

An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server…

Do this now

Upgrade GitLab CE/EE to 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3, or 19.5.1 for your branch.

First seen: 23 Oct 2026
Last update: 23 Oct 2026, 19:19 UTC
Identifiers: CVE-2026-110264
CVSS: 10.0
Source: news
On the menu as: GitLab

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## GitLab CE/EE: security advisory
Severity: critical. Patch status: fix status unknown.
Affected: GitLab CE/EE
Ids: CVE-2026-110264

An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server…

## Steps
1. This touches infrastructure (gitlab). Look in terraform, ansible, cloud-init, Dockerfiles and docs for the product and version we run. If it isn't in the repo, say so and list what a human should check on the box.
2. There is no fix yet. Until one ships: An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server…

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-110264") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/ https://nvd.nist.gov/vuln/detail/CVE-2026-110264
https://pwned.coffee/i/an-issue-has-been-discovered-in-gitlab-ce-ee-affecting-a-cve-2026-110264

Timeline

23 Oct 2026, 19:20 UTC
Proof-of-concept code for CVE-2026-110264 is public on GitHub. Unverified, but expect scanning to follow.
23 Oct 2026
First reported.

Sources

Totalone very hot coffee