GitLab critical patches include one for a bug that allows code execution by unauthenticated users

Summary

GitLab published patched Community Edition and Enterprise Edition releases that fix a dozen bugs, including critical CVE-2026-110264, an integer overflow that could let an unauthenticated user execute arbitrary code on the GitLab server when compiling a specially crafted regular expression. The patches also fix high-severity CVE-2026-15723, an improper authentication flaw in the OmniAuth-to-LDAP auto-linking email lookup that could let an authenticated user take over an LDAP-backed account when OmniAuth SAML and LDAP auto-linking were both enabled.

Mitigation

Fixed in GitLab CE/EE versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13. Affected versions include all releases from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1.

Related items

• HighCVE-2026-115419 - Unintended disclosure of data element to wrong session in Strands Agents SDK A2A ServerSimilar attack · AWS Security Bulletins
• CriticalCVE-2026-114612: LiteLLM admin access via forged credential replay enables MCP stdio commandsSimilar attack · NVD/CVE Database
• LowThird-party evaluators found vulnerabilities in OpenAI monitoring system during test pilotSimilar attack · CNBC Technology
• InfoSomeone hacked the Switch 2 by using an old game and AISimilar attack · The Verge (AI)
• MediumChinese hackers spied on thousands of companies after breaching IT giant ConnectWiseSimilar attack · TechCrunch (Security)