https://reddit.com/r/sysadmin/comments/1xhxa3z/gitlab_a_critical_1010_vulnerability_that_went/: GitLab: a critical 10/10 vulnerability that went undetected for 12 years - how to protect your server

Q: Which GitLab deployments need action?

Self-managed GitLab instances are affected if they run any version from 7.0 onward. GitLab.com is already patched.

Q: Does applying the earlier out-of-band October update address this issue?

No. The October 12 release addressed a different critical issue, CVE-2026-97229; instances updated only to that release remain vulnerable to CVE-2026-110264.

Q: What must an attacker be able to do to exploit the flaw?

The issue is unauthenticated remote code execution. It can be triggered through a crafted file that GitLab renders in the browser.

Q: What can be done if an immediate upgrade is not possible?

No workaround is provided. Upgrading is the only stated mitigation.

Q: Which releases contain the fix?

The October 21 fixes are in 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13.

Published Oct 28, 2026

Updated

Affected Software

1 affected component

GitLab GitLab>=7.0<=18.10, >=18.11.0<=18.11.12, >=19.0.0<=19.0.9, >=19.1.0<=19.1.8, >=19.2.0<=19.2.8, >=19.3.0<=19.3.5, >=19.4.0<=19.4.2, =19.5.0

Frequently Asked Questions

Which GitLab deployments need action?

Self-managed GitLab instances are affected if they run any version from 7.0 onward. GitLab.com is already patched.

Does applying the earlier out-of-band October update address this issue?

No. The October 12 release addressed a different critical issue, CVE-2026-97229; instances updated only to that release remain vulnerable to CVE-2026-110264.

What must an attacker be able to do to exploit the flaw?

The issue is unauthenticated remote code execution. It can be triggered through a crafted file that GitLab renders in the browser.

What can be done if an immediate upgrade is not possible?

No workaround is provided. Upgrading is the only stated mitigation.

Which releases contain the fix?

The October 21 fixes are in 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13.

https://reddit.com/r/sysadmin/comments/1xhxa3z/gitlab_a_critical_1010_vulnerability_that_went/: GitLab: a critical 10/10 vulnerability that went undetected for 12 years - how to protect your server

Affected Software

Frequently Asked Questions

Which GitLab deployments need action?

Does applying the earlier out-of-band October update address this issue?

What must an attacker be able to do to exploit the flaw?

What can be done if an immediate upgrade is not possible?

Which releases contain the fix?

Company

Resources

Contact

Frequently Asked Questions

Which GitLab deployments need action?

Does applying the earlier out-of-band October update address this issue?

What must an attacker be able to do to exploit the flaw?

What can be done if an immediate upgrade is not possible?

Which releases contain the fix?