Security incidents tagged GitLab. Newest first.
Brought to you byTinkerer Club
The private club for people who own their servers, run their own AI, and pay $0/month for software.
On Nov 2 2026 an attacker used a flaw in GitBook's SSO login flow to create sessions as GitBook staff, pulled credentials for a misconfigured internal GitHub App to reach GitBook's code repositories and a Cloudflare API key, and from there reached production secrets with full infrastructure access. GitBook took its app offline for about 16 hours (20:32 UTC Nov 2 to 11:56 UTC Nov 3), rotated every infrastructure and GitBook-managed customer secret, and invalidated all API tokens. It says the attack targeted one customer, but treats all customer data as exposed: API tokens, integration tokens and secrets, session signing secrets, authenticated-access docs, content, and the ability to act as the GitBook GitHub and GitLab apps in repositories customers had granted. GitBook says it can't tell whether the attacker acted in customer repositories. Billing data and passwords were not affected. Customers should create new API tokens, rotate third-party and integration secrets, regenerate authenticated-access signing keys, re-authenticate the GitBook MCP server, review connected repositories, and check logs for the published IPs.
GitBook (hosted documentation platform)Since Nov 2, 2026
Ruby released 4.0.9, 3.4.12 and 3.3.13 on Oct 23 2026 to fix bugs in its Onigmo regular-expression engine (a double free and integer overflows) that GitLab turned into remote code execution on its servers, tracked by GitLab as CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264. Any Ruby app that compiles a regex from an attacker-controlled string (Regexp.new, Regexp.union, Regexp.compile or /#{input}/) is exposed; Regexp.timeout and pattern-length limits do not protect. Apps that only use their own hard-coded regexes are not affected. Ruby 3.2 and older are end-of-life and get no fix.
Ruby (CRuby / Onigmo regex engine)Since Oct 23, 2026
GitLab released a critical patch on Oct 21 2026 for CVE-2026-110264: an integer overflow in the bundled Onigmo / regex compiler that can allow an unauthenticated attacker to execute code on self-managed GitLab. CVSS 10.0; every CE/EE version from 7.0 (2014) is in range. Instances that only applied the Oct 12 regex fix remain vulnerable and must upgrade again.
GitLab CE/EE (self-managed)Since Oct 21, 2026
GitLab Community Edition and Enterprise Edition
GitLab Community Edition and Enterprise Edition contains a path traversal vulnerability that allows an unauthenticated user to read arbitrary files due to an improper path confinement and missing authentication enforcement in the repository commits API. Added to CISA KEV on 2026-09-11.
Red Hat Consulting self-managed GitLab No fix needed
The Crimson Collective broke into a self-managed GitLab instance used by Red Hat Consulting and claimed about 570 GB from 28,000 repos, including roughly 800 Customer Engagement Reports with infrastructure, config and credential details. Red Hat confirmed the access and said its products, supply chain and hosted services were not affected. ShinyHunters later joined the extortion.
GitLab CE/EE
GitLab Community and Enterprise Editions contain an improper access control vulnerability. This allows an attacker to trigger password reset emails to be sent to an unverified email address to ultimately facilitate an account takeover. Added to the CISA KEV catalog on 2024-05-01. CVE-2023-7028 was assigned before 2024; the KEV listing came in 2024.
We released Ruby 4.0.9, 3.4.12, and 3.3.13, and published an announcement about Regexp compilation fixes. t.co/zTemAPrS2A If your application compiles a regular expression from an untrusted string, please update your Ruby to one of those versions.
米GitLabは10月21日（現地時間）、開発プラットフォーム「GitLab」に深刻（Critical）な脆弱性（CVE-2026-110264）が見つかったと発表し、修正版を公開した。CVSSスコアは最大の「10.0」。特定の条件下で、認証されていないユーザーがGitLabサーバ上で任意のコードを実行できる可能性がある… t.co/9RBiQlMg8N
patched self-managed GitLab on 12 Oct? patch again. that release fixed a CVSS 10 regex RCE at 19.4.2. yesterday's CVE-2026-110264 is another CVSS 10 in the regex compiler, and 19.4.2 is still in range. fixed: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13
Si parcheaste tu GitLab hace 9 días y te quedaste tranquilo, tengo malas noticias: vuelves a estar expuesto. GitLab ha corregido hoy el CVE-2026-110264, puntuado con un 10 sobre 10 en CVSS. Permite ejecutar código en el servidor sin iniciar sesión. Afecta a todas las versiones