---
title: GitLab CVE-2026-110264 (CVSS 10.0 regex RCE): patch self-managed in 72 hours | ctxsec
url: https://ctxsec.com/playbooks/gitlab-cve-2026-110264-72h
---

[← Playbooks](/playbooks)

# GitLab CVE-2026-110264 (CVSS 10.0 regex RCE): patch self-managed in 72 hours

Checklist for self-managed GitLab CE/EE after the Oct 21 critical patch that reaches back to version 7.0. Built from GitLab's patch notes.

For: Security lead, GitLab / DevOps admin, SOC

[1. Confirm you are in scope](#s1)[2. Patch](#s2)[3. Hunt while you patch](#s3)[4. Reduce exposure if you cannot upgrade today](#s4)

1.

Step 1 of 4

__

### Confirm you are in scope

SaaS is already patched; self-managed needs action.

   - Check Admin → Monitoring → System Info (or `cat /opt/gitlab/embedded/service/gitlab-rails/VERSION`) against fixed builds: 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3, 19.5.1
   - Inventory every CE/EE instance (prod, staging, DR, air-gapped) — the bug dates to 7.0
   - Remember Oct 12's CVE-2026-97229 patch is not sufficient by itself

2.

Step 2 of 4

__

### Patch

Upgrade to the fixed build for your major/minor line.

   - Follow GitLab's upgrade path; single-node upgrades need a maintenance window for migrations
   - Multi-node: use documented zero-downtime procedures where available
   - Backup first; verify runners and Geo secondaries after

3.

Step 3 of 4

__

### Hunt while you patch

GitLab shipped two detections with this CVE.

   - Alert on Onigmo native worker crashes
   - Alert on bursts of org-mode render errors
   - Review unauthenticated request spikes that coincide with 5xx from regex-heavy endpoints

4.

Step 4 of 4

__

### Reduce exposure if you cannot upgrade today

These are stopgaps only.

   - Put a WAF / authenticated reverse proxy in front of self-managed GitLab
   - Restrict anonymous access and public project features you do not need
   - Schedule the upgrade within 72 hours — CVSS 10.0 unauthenticated RCE is not a 'next sprint' item

Original content by ctxsec. Printable checklist: use your browser's print view.