GitLab: remote code execution

GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server…

Do this now

Upgrade GitLab CE/EE to 18.11.13, 19.0.10, or 19.1.9 matching your release line now.

Fix it

GitLab

On 18.11.xUpgrade to GitLab 18.11.13
On 19.0.xUpgrade to GitLab 19.0.10
On 19.1.xUpgrade to GitLab 19.1.9
On 19.2.xUpgrade to GitLab 19.2.9
On 19.3.xUpgrade to GitLab 19.3.6
On 19.4.xUpgrade to GitLab 19.4.3
On 19.5.xUpgrade to GitLab 19.5.1

First seen: 21 Oct 2026
Last update: 23 Oct 2026, 19:19 UTC
Fixed in: 19.5.1
19.4.3
19.3.6
19.2.9
19.1.9
19.0.10
18.11.13
Identifiers: CVE-2026-110264
CVSS: 10.0
Source: news
On the menu as: GitLab

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## GitLab: remote code execution
Severity: critical. Patch status: patched.
Affected: GitLab
Fixed in: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13
Ids: CVE-2026-110264

An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server…

## Steps
1. This touches infrastructure (gitlab). Look in terraform, ansible, cloud-init, Dockerfiles and docs for the product and version we run. If it isn't in the repo, say so and list what a human should check on the box.

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-110264") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://www.theregister.com/security/2026/10/22/max-severity-gitlab-bug-allows-remote-code-execution-over-12-years-of-releases/5304854 https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/ https://nvd.nist.gov/vuln/detail/CVE-2026-110264
https://pwned.coffee/i/an-issue-has-been-discovered-in-gitlab-ce-ee-affecting-a-cve-2026-110264

Receipt

Exploitation: No known exploitation
Fix by release line: Product Affected Fixed in Source
GitLab 19.5 to before 19.5.1 19.5.1 CVE record (CNA)
GitLab 19.4 to before 19.4.3 19.4.3 CVE record (CNA)
GitLab 19.3 to before 19.3.6 19.3.6 CVE record (CNA)
GitLab 19.2 to before 19.2.9 19.2.9 CVE record (CNA)
GitLab 19.1 to before 19.1.9 19.1.9 CVE record (CNA)
GitLab 19.0 to before 19.0.10 19.0.10 CVE record (CNA)
GitLab before 18.11.13 18.11.13 CVE record (CNA)
Score: CVSS 10.0 (critical). CVSS 3.1 10 (CNA GitLab) for CVE-2026-110264
Last checked: 24 Oct 2026, 17:17 UTC

Product	Affected	Fixed in	Source
GitLab	19.5 to before 19.5.1	19.5.1	CVE record (CNA)
GitLab	19.4 to before 19.4.3	19.4.3	CVE record (CNA)
GitLab	19.3 to before 19.3.6	19.3.6	CVE record (CNA)
GitLab	19.2 to before 19.2.9	19.2.9	CVE record (CNA)
GitLab	19.1 to before 19.1.9	19.1.9	CVE record (CNA)
GitLab	19.0 to before 19.0.10	19.0.10	CVE record (CNA)
GitLab	before 18.11.13	18.11.13	CVE record (CNA)

Sources: KEV – CVE record ✓ Vendor ✓

Sources

Totalone very hot coffee