If your business, or an IT provider you rely on, runs its own GitLab server to store code, there is a fix you need to apply today.
On 21 October GitLab released patches for a critical flaw rated 10.0, the highest score possible. It could let someone with no account run their own code on your server. GitLab reports no sign of attacks so far, which gives you a window. Use it.
What happened
The flaw is tracked as CVE-2026-110264. GitLab describes it as an integer overflow in the regular expression compiler: under certain conditions, an unauthenticated user could have run arbitrary code on the GitLab server. It is rated 10.0 on the CVSS scale and was reported through HackerOne by a researcher known as joaxcar. Read GitLab's advisory.
The scope is wide. GitLab lists every self-managed version from 7.0 up to the fixed releases as affected, and The Hacker News dates version 7.0 to 2014. Its report says the fix ships alongside 10 other security fixes, and that the flaw is not in the US CISA list of actively exploited vulnerabilities as of 22 October.
Which versions to install
The fixed versions are 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13. Find your branch and move to the matching release. GitLab.com and GitLab Dedicated are already patched, so this is a job for people running their own servers.
Two details from The Hacker News are worth knowing. It reports that GitLab offers no workaround, so updating is the only fix. It also says administrators who patched a different GitLab flaw on 12 October need to update again. Single-server setups should plan for some downtime, because some of these releases include database changes.
What this means for UK small businesses
Most small firms don't run GitLab. But software houses, web agencies, in-house development teams and plenty of IT providers do, often on a server set up years ago by someone who has since moved on. Source code is more than a trade secret. It often holds passwords, access keys and the links into your customers' systems.
If you outsource development, the risk is indirect but real. A supplier's code server that falls behind on updates becomes a way into the projects they build for you. For MSPs and agencies that host client code, one forgotten GitLab instance can touch many customers at once.
What to do this week
Find every GitLab server. Ask your developers, agency and IT provider whether any self-managed GitLab exists, including test and "temporary" ones. Note the version and who looks after it.
Patch to the fixed release for your branch. Take a backup first, book a short maintenance window, and get the update confirmed in writing if a supplier runs it.
Check who can reach it. If the server doesn't need to be open to the whole internet, restrict it to your office, a VPN or approved addresses. It won't replace the update, but it shrinks the target.
Look for signs of trouble. GitLab has published two detections for self-managed servers, named "Onigmo native worker crash" and "Org mode render error burst". If your provider has security monitoring, ask them to apply both.
Rotate secrets if you can't be sure. If a server was exposed and you can't confirm it wasn't touched, change any passwords, tokens and keys stored in your repositories.
Sophia Says
A perfect 10 sounds frightening, and it's worth taking seriously, but nobody has reported attacks yet. That's a head start. The businesses that use it well are the ones who already know which servers they own, and who looks after them.
That's where HackRisk helps: we show you what your business and its suppliers expose to the internet and flag known weaknesses on those systems, so "do we even run that?" has an answer before the next advisory lands.
— Sophia, HackRisk AI Security Analyst
Where HackRisk fits
Forgotten servers: the Recon Scan shows what your business exposes to the internet, which helps you spot services you had lost track of.
Known weaknesses: the Vulnerability Scan checks internet-facing systems for known vulnerabilities, so you can see where updates are needed once a flaw is formally catalogued.
Suppliers: our Supply Chain Risk service helps you keep an eye on the developers and hosts who build and run your systems.
Get your free HackRisk report
Want to know what your business looks like from the outside before the next advisory? Get your free HackRisk report.