{"id":10140,"date":"2026-10-22T20:29:05","date_gmt":"2026-10-22T20:29:05","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=10140"},"modified":"2026-10-22T20:29:05","modified_gmt":"2026-10-22T20:29:05","slug":"gitlab-critical-patches-include-one-for-a-bug-that-allows-code-execution-by-unauthenticated-users","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=10140","title":{"rendered":"GitLab critical patches include one for a bug that allows code execution by unauthenticated users"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

GitLab on Wednesday published updated versions of its Community Edition (CE) and Enterprise Edition (EE) that address a dozen bugs and security issues, including some that allow various unauthenticated actions.\u00a0<\/p>\n

The most serious of the security issues, labeled critical in severity, is CVE-2026-110264<\/a>, an integer overflow issue. \u201cGitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression,\u201d GitLab said in its bulletin<\/a>. \u201cIn addition to our standard patch releases, we have backported this fix to GitLab CE\/EE versions 18.11.13, 19.0.10, 19.1.9, and 19.2.9.\u201d<\/p>\n

Impacted versions of GitLab CE\/EE include all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1.<\/p>\n

The patched releases are versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13.\u00a0<\/p>\n

The patches also fix a high severity flaw tracked as CVE-2026-15723<\/a>, an improper authentication issue in OmniAuth-to-LDAP auto-linking email lookup that impacts GitLab CE\/EE, which is an issue, GitLab said, because \u201cwhen OmniAuth SAML and LDAP auto-linking were both enabled, an authenticated user could have taken over an existing LDAP-backed account without any interaction from the targeted user, due to improper input sanitization in the LDAP email lookup path used during OmniAuth identity linking.\u201d<\/p>\n

This is the fourth critical security issue that GitLab has experienced within two months. Earlier in October, it patched a maximum severity regex flaw<\/a>, and in September, it fixed CVE-2026-85706<\/a>, also rated perfect 10 in severity. Another September report also revealed a concerning issue: a long-lived token that puts CI\/CD security at risk<\/a>. \u00a0<\/p>\n

Immediate action needed<\/h2>\n

Analysts and consultants agreed that the current holes are serious and merit immediate action.<\/p>\n

\u201cWhat really stands out to me is the underlying source of the vulnerability,\u201d said Noah Kenney<\/a>, principal consultant at Digital 520. \u201cThe issue originates in an integer overflow within the regular expression compiler, rather than functionality developed specifically by GitLab.\u201d<\/p>\n

He pointed out that this distinction is important because it highlights the risks associated with dependencies and shared software components. \u201cOrganizations can invest heavily in securing their own applications while remaining exposed to vulnerabilities introduced through underlying libraries and frameworks,\u201d he said. \u201cThe fact that this issue potentially affects releases dating back to GitLab 7.0 demonstrates how long these vulnerabilities can persist before being identified and remediated.\u201d<\/p>\n

Kenney added that CISOs should pay particular attention to one brief mention within the GitLab post.<\/p>\n

\u201cBuried in the bug fixes, not even in the CVE list, is a line about stripping the trusted flag from client-supplied MCP tools in Workhorse,\u201d he said. \u201cIn plain terms, GitLab found a path where an AI agent could be handed tools it should not have trusted and quietly closed it. This raises an important issue surrounding trust boundaries in AI-enabled systems.\u201d<\/p>\n

Frank Dickson<\/a>, principal analyst at Dickson Research, noted that the holes are especially troubling because of the highly-integrated nature of GitLab systems.<\/p>\n

\u201cGitLab is not just a code repository. It holds the source code, the CI\/CD pipelines, and very often the secrets those pipelines use to deploy to production,\u201d he said. \u201cOwning the GitLab server means owning the keys to the kingdom. An attacker does not need to break into production when the system that builds production will do it for them.\u201d<\/p>\n

Dickson also flagged the fact that these fixes may need a lot of time to deploy.<\/p>\n

\u201cPlan for downtime,\u201d he said. \u201cGitLab\u2019s release notes say this patch includes database migrations, and single-node instances will be down while they run. Someone will ask to wait for the weekend. Waiting is a risk acceptance. That decision belongs to an executive, not to the DevOps team.\u201d<\/p>\n

Additional risks<\/h2>\n

In addition, he pointed out that the nature of these flaws is a strong heads-up that many other enterprise vendors might also suffer from similar issues.\u00a0<\/p>\n

\u201cThe flaw sits in Ruby, not just in GitLab\u2019s own code. GitLab\u2019s release notes show the fix ships as a patch to Ruby\u2019s regular expression handling, and one of its detections is named for Onigmo, Ruby\u2019s regex engine,\u201d Dickson said. \u201cGitLab may not be the only Ruby application carrying this bug. CISOs should ask their other vendors.\u201d<\/p>\n

As well, Ty Coffee<\/a>, principal at advisory firm UHY, noted that the LDAP bug raises the risk that a post-breach investigation could accidentally point the finger at an innocent employee.\u00a0<\/p>\n

\u201cIf an attacker takes over an LDAP-backed account, everything they do is logged under a legitimate employee\u2019s name, and your audit trail then points at the wrong person,\u201d Coffee said. \u201cCISOs should also check for shadow and legacy GitLab servers such as team-run instances, old DR copies, acquired-company servers, [because] this affects older versions and that means forgotten boxes are in scope.\u201d<\/p>\n

This article originally appeared on InfoWorld<\/a>.<\/em><\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

GitLab on Wednesday published updated versions of its Community Edition (CE) and Enterprise Edition (EE) that address a dozen bugs and security issues, including some that allow various unauthenticated actions.\u00a0 The most serious of the security issues, labeled critical in severity, is CVE-2026-110264, an integer overflow issue. \u201cGitLab has remediated an issue that, under certain […]<\/p>\n","protected":false},"author":0,"featured_media":10139,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-10140","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/10140"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=10140"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/10140\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/10139"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=10140"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=10140"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=10140"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}