Multiple vulnerabilities have been identified in GitLab Community Edition and Enterprise Edition, affecting versions prior to specific patched releases. The flaws range from critical remote code execution to various access control and information disclosure issues, posing significant risks to self-hosted instances. Administrators must address these defects to protect their infrastructure from exploitation.
CVE-2026-110264 (CVSS 10.0 — Critical): A critical integer overflow in the Regular Expression Compiler allows an unauthenticated remote attacker to execute arbitrary code on the host by triggering the overflow through a specially crafted regular expression.[/subscribe_to_unlock_form]
Multiple vulnerabilities have been identified in GitLab Community Edition and Enterprise Edition, affecting versions prior to specific patched releases. The flaws range from critical remote code execution to various access control and information disclosure issues, posing significant risks to self-hosted instances. Administrators must address these defects to protect their infrastructure from exploitation.
CVE-2026-110264 (CVSS 10.0 — Critical): A critical integer overflow in the Regular Expression Compiler allows an unauthenticated remote attacker to execute arbitrary code on the host by triggering the overflow through a specially crafted regular expression.[emaillocker id="1283"]
CVE-2026-15723 (CVSS 8.2 — High): A high-severity authentication flaw in OmniAuth-to-LDAP auto-linking permits an authenticated attacker to take over existing LDAP-backed accounts without user interaction due to a lack of proper input sanitization when both SAML and LDAP auto-linking are active.
CVE-2026-112212 (CVSS 7.5 — High): A cache poisoning bug in OAuth/OIDC discovery endpoints enables unauthenticated attackers to redirect authentication flows to external servers.
CVE-2026-12664 (CVSS 6.8 — Medium): A medium-severity flaw allows read_api tokens to retrieve project email addresses and create work items via GraphQL.
CVE-2026-16255 (CVSS 5.9 — Medium): A medium-severity issue bypasses SAML/LDAP membership locks, potentially allowing unauthorized access to restricted resources.
CVE-2026-105777 (CVSS 4.3 — Medium): A medium-severity information disclosure flaw exposes internal server credentials through improperly filtered response headers.
CVE-2026-13319 (CVSS 4.3 — Medium): It is an authorization vulnerability in GitLab CE/EE that allows authenticated attackers to access milestone metadata from arbitrary private projects without project membership due to missing authorization checks in the group milestones API.
CVE-2026-112378 (CVSS 4.3 — Medium): It is a billing validation vulnerability in GitLab EE that allows authenticated users to access paid AI features without a valid subscription due to insufficient server-side validation of billing eligibility checks.
CVE-2026-105711 (CVSS 3.5 — Low): It is a vulnerability in GitLab CE/EE that allows authenticated users without project membership to view confidential issue titles from private projects through improperly shared fragment cache entries in public merge requests.
CVE-2026-14288 (CVSS 3.1 — Low): It is an access control vulnerability in GitLab EE that allows authenticated users to bypass required merge request approval policies on protected branches due to improper access control during approval rule synchronization.
CVE-2026-112326 (CVSS 3.1 — Low): It is a vulnerability in GitLab EE that allows authenticated users with read-only permissions to permanently delete existing vulnerability records due to improper cleanup logic during error handling.
CVE-2026-103515 (CVSS 2.7 — Low): It is a vulnerability in GitLab EE that allows authenticated group Owners to re-enable AI-backed data sharing with third-party services despite an instance administrator locking Duo availability, due to insufficient enforcement of administrative controls.
We recommend you to update GitLab CE/EE to version 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3, or 19.5.1 or later.
The following reports contain further technical details:
[/emaillocker]