GitLab released critical patch versions on October 21, 2026, including versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13 for both Community Edition (CE) and Enterprise Edition (EE). According to the release notes, these versions contain important bug and security fixes, and GitLab strongly recommends that all self-managed installations be upgraded immediately. GitLab.com is already running the patched version, and GitLab Dedicated tenants running 19.3.5-internal0 and 19.4.2-internal0 or later already include the fixes.
The most critical vulnerability addressed is CVE-2026-110264, an integer overflow issue in the regular expression compiler that impacts GitLab CE/EE. According to the security advisory, under certain conditions this vulnerability could have allowed an unauthenticated user to execute arbitrary code on the GitLab server. The issue received a CVSS score of 10.0 (critical). The fix has been backported to versions 18.11.13, 19.0.10, 19.1.9, and 19.2.9, affecting all versions from 7.0 before the patched releases.
Additional significant vulnerabilities include CVE-2026-15723, an improper authentication issue in OmniAuth-to-LDAP auto-linking that could have allowed an authenticated user to take over an existing LDAP-backed account without user interaction (CVSS 8.2), and CVE-2026-112212, a cache poisoning issue in OAuth/OIDC discovery endpoints that could have allowed unauthenticated users to redirect authentication flows to external servers (CVSS 7.5).
Other patched vulnerabilities include improper access control in GraphQL work item fields (CVE-2026-12664, CVSS 6.8), incomplete enforcement of instance-wide SAML/LDAP membership locks (CVE-2026-16255, CVSS 5.9), internal credential exposure in response headers (CVE-2026-105777, CVSS 4.3), authorization bypass in group milestones API (CVE-2026-13319, CVSS 4.3), insufficient validation in AI Gateway billing checks (CVE-2026-112378, CVSS 4.3), and cache issues in merge request title rendering (CVE-2026-105711).
GitLab releases patches twice monthly on the second and fourth Wednesdays, with ad-hoc critical patches issued for high-severity vulnerabilities. Security issues are made public on the issue tracker 90 days after patching. GitLab recommends all customers upgrade to the latest patch release for their supported version to maintain security hygiene.
Key facts
- GitLab released patches on October 21, 2026, including versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13
- CVE-2026-110264 is a critical integer overflow vulnerability (CVSS 10.0) that could allow unauthenticated arbitrary code execution
- CVE-2026-15723 (CVSS 8.2) allows authenticated users to take over LDAP-backed accounts via improper OmniAuth-LDAP auto-linking
- CVE-2026-112212 (CVSS 7.5) enables cache poisoning of OAuth/OIDC discovery endpoints
- The patches affect versions from 7.0 to 19.5 depending on the vulnerability
- GitLab.com and Dedicated instances are already patched; self-managed installations must upgrade immediately