critical severityConfidence highHistorical record

GitLab servers taken over with no login through a crafted Org-mode file, even after the Oct 12 patch (CVE-2026-110264)

Direct answer

GitLab servers taken over with no login through a crafted Org-mode file, even after the Oct 12 patch (CVE-2026-110264), also tracked as CVE-2026-110264 / GitLab Onigmo regex RCE / GitLab Org-mode RCE is a critical-severity threat campaign HOL Guard tracked from Oct 21, 2026 to Oct 21, 2026, verified against 5 primary sources and last reviewed Oct 21, 2026. Active tracking has ended and the record remains published as a permanent historical research record.

CVE-2026-110264 (CVSS 10.0, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) is an integer overflow in Onigmo, the Ruby regular expression engine bundled with GitLab CE/EE, that can let an unauthenticated user execute arbitrary code on a self-managed GitLab server. GitLab's detection write-ups describe the path: the org-ruby gem that renders .org files interpolates a raw #+TODO: keyword into Regexp.new, and a keyword with more than 32,767 generic repeats wraps Onigmo's signed 16-bit repeat ID, causing an out-of-bounds write at match time that GitLab says can be turned into a system() call as the git user. Every version from 7.0 is affected. GitLab fixed it on 2026-10-21 in 19.5.1, 19.4.3 and 19.3.6 and backported the fix to 19.2.9, 19.1.9, 19.0.10 and 18.11.13. The Oct 12 fixes for CVE-2026-97229 (19.4.2, 19.3.5, 19.2.8) are below the new fixed versions, so those servers are exposed again. Reported by joaxcar through HackerOne.

Also tracked as CVE-2026-110264 · GitLab Onigmo regex RCE · GitLab Org-mode RCE · GitLab org-ruby TODO keyword overflow · GitLab 19.5.1 critical patch

First observed
Oct 21, 2026
Last observed
Oct 21, 2026
Last reviewed
Oct 21, 2026
Tracking ended
Oct 21, 2026

Record exports

JSON recordArtifact CSVSTIX 2.1 bundle

Uncertainty and limitations

Read the evidence limits before acting on this record.

GitLab's advisory says only 'under certain conditions'; the Org-mode mechanism comes from GitLab's TLDR detection write-ups, not the advisory text. The CVE record and NVD entry were not yet published at campaign creation. GitLab reports no exploitation in the wild and the issue is not in the CISA KEV catalog (2026.10.21). Backport packages for 18.11-19.1 list a differently named Ruby regexp patch than the 19.2+ trains.

  • GitLab.com is already patched
  • GitLab Dedicated tenants on 19.3.5-internal0 / 19.4.2-internal0 or later already include the fix
  • GitLab Runner is not named in the advisory
  • The 18.11-19.2 backports carry only the critical fix, not the other security fixes in the same release
  • Source installs on a self-built Ruby may need the Ruby runtime patch separately
  • Absence of crash logs does not rule out a quiet successful exploit

Guard coverage and policy

What Guard's reviewed assertions do and do not claim for this campaign, and the reviewed starting points for defense.

Not covered, or partially covered

  • not covered

    HOL Guard reviews AI agent actions on developer machines. It does not sit in front of a GitLab server and does not block this exploit; the fix is the GitLab upgrade.

No campaign-specific policy guidance is published.

Safe next step. Campaign guidance is defensive context. It does not auto-apply policy or claim universal campaign coverage.

Open policy controlsCampaign-specific emergency policy starting point

Timeline

Reviewed events, oldest first, each tied to a verified source.

  1. Vendor action

    GitLab fixes sibling Onigmo CI regex RCE CVE-2026-97229 in 19.4.2, 19.3.5 and 19.2.8; those versions remain affected by CVE-2026-110264.

    Sources:GitLab Critical Patch Release: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13·HOL blog: GitLab CVE-2026-110264 operator write-up

  2. Update

    GitLab security publishes Sigma detections 'Onigmo native worker crash' and 'Org mode render error burst' for self-managed instances.

    Sources:GitLab TLDR detection: Org mode render error burst (CVE-2026-110264)·GitLab TLDR detection: Onigmo native worker crash

  3. Vendor action

    GitLab releases 19.5.1, 19.4.3, 19.3.6 and backports 19.2.9, 19.1.9, 19.0.10, 18.11.13 fixing CVE-2026-110264 (CVSS 10.0); GitLab.com already patched.

    Source:GitLab Critical Patch Release: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13

  4. Update

    HOL publishes the operator write-up with upgrade table, log checks and scope notes.

    Source:HOL blog: GitLab CVE-2026-110264 operator write-up

Publication clock: 0.1 hours from reviewed disclosure timestamp to HOL publication; 12-hour critical target; within target.

Reviewed artifacts

The specific artifacts this record concerns, as reviewed. Names and versions are shown as text; a registry link is not recorded here.

  • GitLab CE/EE (self-managed)@>=7.0 <18.11.13; 19.x before 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3, 19.5.1omnibuspackage

Sources

Every claim on this record is traceable to the sources below.

Related reviewed records

Records this one was reviewed against. Every relationship below is part of a released revision, with the reviewer’s stated reason.

Campaign questions, answered

CVE-2026-110264 (CVSS 0, HOL Guard tracked the campaign from Oct 21, 2026 to Oct 21, 2026.

No. Active tracking ended Oct 21, 2026; this page remains as a labeled historical research record and does not imply the threat is currently active.

The record cites 5 primary sources, names 1 reviewed artifact, and was last fully reviewed Oct 21, 2026 by HOL Guard Security Publishing. Its uncertainty and limitations are stated on the record itself.

Campaign guidance is defensive context. It does not auto-apply policy or claim universal campaign coverage.

The permalink above is permanent. The full record can be downloaded from this page as JSON, an artifact CSV, and a STIX 2.1 bundle, and corrections can be requested through the published correction path on the record. GitLab's advisory says only 'under certain conditions'; the Org-mode mechanism comes from GitLab's TLDR detection write-ups, not the advisory text. The CVE record and NVD entry were not yet published at campaign creation.

Reviewed in full by HOL Guard Security Publishing.

Published
Last full review
Last modified

Report a correction

Record HGTC-2026-0D445FE1