GitLab October release (12 CVEs): unauthenticated RCE via crafted compile input

What happened

On 22 October 2026, GitLab shipped a security release — 19.3.6, 19.4.3, and 19.5.1 — fixing twelve CVEs at once. The headline is CVE-2026-110264: an integer overflow when compiling a specially crafted input that could let an unauthenticated user execute arbitrary code on the GitLab server, affecting every version line from 7.0 up. The batch also includes CVE-2026-105711 (a merge request in a public project leaking a confidential issue from a private project to authenticated users) plus ten more across EE/CE components.

Impact

Unauthenticated RCE on the box that holds all source code, CI secrets, and signing keys is about as bad as it gets: stolen code, poisoned pipelines, and runner tokens that reach production. The confidential-issue leak is quieter but burns trust in private-project boundaries — exactly the guarantee enterprise plans pay for.

Root cause in one paragraph

One code path compiled attacker-shaped input with arithmetic that could overflow, flipping a size or bounds check and opening code execution without any login; the companion issues were authorization checks that compared the wrong scope — public context against private objects.

What to do now

• Upgrade self-managed GitLab to 19.3.6 / 19.4.3 / 19.5.1 (match your line) immediately; GitLab.com is already patched.
• Review gitlab-rails/production.log for unauthenticated hits on compile/import endpoints around 22 October.
• Rotate runner registration tokens and any CI variables that lived on the instance.
• Audit confidential issues referenced from public merge requests for unexpected viewers.
• Keep patch releases on auto-upgrade policy — GitLab ships these monthly and attackers diff them within hours.

What this means for Magento stores

Most Magento teams build and deploy from GitLab: CI holds Adobe Commerce credentials, API tokens, and production SSH keys. A compromised GitLab is a compromised store pipeline — poisoned artifacts deploy themselves. Patch the forge first, rotate the secrets it held second, and verify the next deploy's checksums like you mean it.

Sources

• NVD: CVE-2026-110264, CVE-2026-105711
• GitLab security release notes, 22 October 2026 (19.3.6 / 19.4.3 / 19.5.1)

Next in this series: Roundcube session desync (CVE-2026-114724) — /blog/cve-2026-roundcube-114724