GitLab releases urgent fixes for unauthenticated code execution flaw
GitLab published Community Edition and Enterprise Edition updates addressing a dozen bugs and security issues. The most severe is CVE-2026-110264, an integer overflow that could let an unauthenticated user execute arbitrary code on a GitLab server. Another high-severity flaw involved account takeover through OmniAuth and LDAP auto-linking, and GitLab urged customers to upgrade immediately.
GitLab’s latest CE and EE releases repair twelve defects, including a critical integer-overflow bug in regex compilation that can be triggered without authentication and may lead to arbitrary code execution. The company also backported the correction to several older release lines.
A second high-severity issue involved OmniAuth and LDAP auto-linking: under specific configurations, an authenticated attacker could seize an existing LDAP-backed account without victim action. Commentators noted the regex compiler flaw stems from shared components, and one flagged a Workhorse change that removes a trusted marker from client-provided MCP tools.
The impact could extend beyond GitLab administrators to any organization whose source code, build pipelines, and deployment secrets sit on the platform. A compromised server may expose proprietary code or allow tampering with software releases, affecting developers, customers, and downstream users. Because fixes require prompt upgrades, smaller teams with limited security resources may face greater exposure. The episode may also reinforce attention to dependency risk and trust boundaries in AI-assisted tooling.