This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] GitLab fixes 12 vulnerabilities

GitLab fixes 12 vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE) in versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13, one of them critical. The most severe ones are described below; the rest can be found at [1].

GitLab - RCE (CVE-2026-110264)
CVSS 10.0 (Critical)

Allows an unauthenticated remote attacker to execute code by compiling a specially crafted regular expression [1]. For this vulnerability, GitLab has released 2 exploitation attempt detections for customers who manage their instances themselves [2][3].

The vulnerability is present in products:

  • GitLab Community Edition; >=7.0, <18.11.13; >=19.0, <19.0.10; >=19.1, <19.1.9; >=19.2, <19.2.9; >=19.3, <19.3.6; >=19.4, <19.4.3; >=19.5, <19.5.1;
  • GitLab Enterprise Edition; >=7.0, <18.11.13; >=19.0, <19.0.10; >=19.1, <19.1.9; >=19.2, <19.2.9; >=19.3, <19.3.6; >=19.4, <19.4.3; >=19.5, <19.5.1;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 21. 10. 2026.

GitLab - account takeover (CVE-2026-15723)
CVSS 8.2 (High)

Allows an authenticated remote attacker, when automatic linking via OmniAuth SAML and LDAP is enabled at the same time, to take over an existing account linked to LDAP without any user interaction [1].

The vulnerability is present in products:

  • GitLab Community Edition; >=10.1, <19.3.6; >=19.4, <19.4.3; >=19.5, <19.5.1;
  • GitLab Enterprise Edition; >=10.1, <19.3.6; >=19.4, <19.4.3; >=19.5, <19.5.1;

CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

More information:

  • CVE-2026-15723 at cve.org, NVD
  • CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 21. 10. 2026.

GitLab - authentication interception (CVE-2026-112212)
CVSS 7.5 (High)

Allows an unauthenticated remote attacker, by manipulating the shared cache on OAuth/OIDC discovery endpoints, to redirect user flows to an external server under certain conditions [1].

The vulnerability is present in products:

  • GitLab Community Edition; >=18.3, <19.3.6; >=19.4, <19.4.3; >=19.5, <19.5.1;
  • GitLab Enterprise Edition; >=18.3, <19.3.6; >=19.4, <19.4.3; >=19.5, <19.5.1;

CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:L

More information:

  • CVE-2026-112212 at cve.org, NVD
  • CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') at cwe.mitre.org

The vulnerability was publicly disclosed 21. 10. 2026.

By CESNET, z.s.p.o. Ondrej Pavlovič on 22. 10. 2026.

CESNET, z.s.p.o. Logo