GitLab shipped an emergency critical patch release on October 21, 2026, covering seven version branches and fixing twelve security vulnerabilities. The headline flaw is a CVSS 10.0 — the maximum possible severity score — an integer overflow in the regular expression compiler that lets an unauthenticated attacker execute arbitrary code on the server. No login, no interaction, no special access required. The bug affects every GitLab CE and EE version since 7.0, released in 2014. The scope of exposure is staggering. GitLab is the DevOps backbone for millions of organizations, hosting source code, CI/CD pipelines, secrets, deployment credentials, and container registries. A CVSS 10.0 unauthenticated RCE on these servers means an attacker could exfiltrate entire codebases, inject malicious code into build pipelines, harvest credentials, or pivot laterally into production infrastructure. GitLab.com and Dedicated tenants are already patched; every self-managed instance on the planet is the target audience. Beyond the critical RCE, the release fixes an 8.2-rated SAML/LDAP account takeover (CVE-2026-15723) where an authenticated user could hijack LDAP-backed accounts via improper input sanitization during OmniAuth identity linking. A 7.5-rated cache poisoning vulnerability in OAuth/OIDC discovery endpoints (CVE-2026-112212) could redirect authentication flows to attacker-controlled servers. Both require specific configurations but are devastating when conditions are met. The medium-severity cluster reveals systemic access control weaknesses: GraphQL fields leaking project email addresses past token scope restrictions, incomplete SAML/LDAP membership lock enforcement allowing unauthorized member additions, internal credential exposure through response headers, authorization bypass in the milestones API leaking private project metadata, and an AI Gateway billing bypass allowing unpaid access to Duo features. Each individually is manageable; collectively they paint a picture of authorization logic that has accumulated debt. GitLab released two threat detection signatures for the RCE — "Onigmo native worker crash" and "Org mode render error burst" — giving defenders indicators to hunt for exploitation attempts. The backport reached six additional version branches including 18.11.13, an unusual depth of backporting that signals GitLab's own assessment of severity. The vulnerability was reported through HackerOne by researcher "joaxcar." The twelve-year window on the RCE is the detail that should keep security teams awake. Version 7.0 shipped in June 2014. Every self-managed GitLab instance deployed since then has carried this bug. The question isn't whether exploitation occurred — it's whether anyone would know if it had. Organizations running self-managed GitLab should treat this as a potential compromise indicator, not just a patch cycle.
