← Playbooks

GitLab CVE-2026-110264 (CVSS 10.0 regex RCE): patch self-managed in 72 hours

Checklist for self-managed GitLab CE/EE after the Oct 21 critical patch that reaches back to version 7.0. Built from GitLab's patch notes.

For: Security lead, GitLab / DevOps admin, SOC

1. Step 1 of 4

   Confirm you are in scope

   SaaS is already patched; self-managed needs action.

   • Check Admin → Monitoring → System Info (or `cat /opt/gitlab/embedded/service/gitlab-rails/VERSION`) against fixed builds: 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3, 19.5.1
   • Inventory every CE/EE instance (prod, staging, DR, air-gapped) — the bug dates to 7.0
   • Remember Oct 12's CVE-2026-97229 patch is not sufficient by itself
2. Step 2 of 4

   Patch

   Upgrade to the fixed build for your major/minor line.

   • Follow GitLab's upgrade path; single-node upgrades need a maintenance window for migrations
   • Multi-node: use documented zero-downtime procedures where available
   • Backup first; verify runners and Geo secondaries after
3. Step 3 of 4

   Hunt while you patch

   GitLab shipped two detections with this CVE.

   • Alert on Onigmo native worker crashes
   • Alert on bursts of org-mode render errors
   • Review unauthenticated request spikes that coincide with 5xx from regex-heavy endpoints
4. Step 4 of 4

   Reduce exposure if you cannot upgrade today

   These are stopgaps only.

   • Put a WAF / authenticated reverse proxy in front of self-managed GitLab
   • Restrict anonymous access and public project features you do not need
   • Schedule the upgrade within 72 hours — CVSS 10.0 unauthenticated RCE is not a 'next sprint' item

Original content by ctxsec. Printable checklist: use your browser's print view.