{ "schemaVersion": "guard-threat-campaign/v1", "id": "HGTC-2026-0D445FE1", "slug": "cve-2026-110264-gitlab-onigmo-regex-unauthenticated-rce", "title": "GitLab servers taken over with no login through a crafted Org-mode file, even after the Oct 12 patch (CVE-2026-110264)", "aliases": [ "CVE-2026-110264", "GitLab Onigmo regex RCE", "GitLab Org-mode RCE", "GitLab org-ruby TODO keyword overflow", "GitLab 19.5.1 critical patch" ], "summary": "CVE-2026-110264 (CVSS 10.0, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) is an integer overflow in Onigmo, the Ruby regular expression engine bundled with GitLab CE/EE, that can let an unauthenticated user execute arbitrary code on a self-managed GitLab server. GitLab's detection write-ups describe the path: the org-ruby gem that renders .org files interpolates a raw #+TODO: keyword into Regexp.new, and a keyword with more than 32,767 generic repeats wraps Onigmo's signed 16-bit repeat ID, causing an out-of-bounds write at match time that GitLab says can be turned into a system() call as the git user. Every version from 7.0 is affected. GitLab fixed it on 2026-10-21 in 19.5.1, 19.4.3 and 19.3.6 and backported the fix to 19.2.9, 19.1.9, 19.0.10 and 18.11.13. The Oct 12 fixes for CVE-2026-97229 (19.4.2, 19.3.5, 19.2.8) are below the new fixed versions, so those servers are exposed again. Reported by joaxcar through HackerOne.", "status": "published", "severity": "critical", "confidence": "high", "uncertainty": "GitLab's advisory says only 'under certain conditions'; the Org-mode mechanism comes from GitLab's TLDR detection write-ups, not the advisory text. The CVE record and NVD entry were not yet published at campaign creation. GitLab reports no exploitation in the wild and the issue is not in the CISA KEV catalog (2026.10.21). Backport packages for 18.11-19.1 list a differently named Ruby regexp patch than the 19.2+ trains.", "firstObservedAt": "2026-10-21T00:00:00Z", "lastObservedAt": "2026-10-21T20:15:10Z", "publishedAt": "2026-10-21T20:22:43.183Z", "reviewedAt": "2026-10-21T20:22:29.651Z", "expiresAt": "2026-10-21T20:15:10Z", "reviewer": "HOL Guard Security Publishing", "sources": [ { "id": "gitlab-release", "label": "GitLab Critical Patch Release: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13", "url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/", "sourceType": "vendor_advisory", "observedAt": "2026-10-21T00:00:00Z" }, { "id": "tldr-org-render", "label": "GitLab TLDR detection: Org mode render error burst (CVE-2026-110264)", "url": "https://gitlab.com/gitlab-security-oss/tldr/-/blob/main/Detections/platforms/GitLab/Vulnerability%20Detections/org_mode_render_error_burst.md", "sourceType": "vendor_advisory", "observedAt": "2026-10-20T00:00:00Z" }, { "id": "tldr-onigmo-crash", "label": "GitLab TLDR detection: Onigmo native worker crash", "url": "https://gitlab.com/gitlab-security-oss/tldr/-/blob/main/Detections/platforms/GitLab/Vulnerability%20Detections/onigmo_native_worker_crash.md", "sourceType": "vendor_advisory", "observedAt": "2026-10-20T00:00:00Z" }, { "id": "thn", "label": "The Hacker News: Critical GitLab flaw (CVSS 10.0) across 12 years of releases", "url": "https://thehackernews.com/2026/10/critical-gitlab-flaw-cvss-100-could.html", "sourceType": "research", "observedAt": "2026-10-21T00:00:00Z" }, { "id": "hol-blog", "label": "HOL blog: GitLab CVE-2026-110264 operator write-up", "url": "https://hol.org/blog/cve-2026-110264-gitlab-onigmo-regex-unauthenticated-rce", "sourceType": "other_primary", "observedAt": "2026-10-21T20:15:10Z" } ], "artifacts": [ { "id": "gitlab-ce-ee", "artifactClass": "package", "ecosystem": "omnibus", "name": "GitLab CE/EE (self-managed)", "version": ">=7.0 <18.11.13; 19.x before 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3, 19.5.1", "defanged": false } ], "indicators": [], "timeline": [ { "id": "oct12-sibling-fix", "occurredAt": "2026-10-12T00:00:00Z", "eventType": "vendor_action", "summary": "GitLab fixes sibling Onigmo CI regex RCE CVE-2026-97229 in 19.4.2, 19.3.5 and 19.2.8; those versions remain affected by CVE-2026-110264.", "sourceIds": [ "gitlab-release", "hol-blog" ] }, { "id": "tldr-detections-published", "occurredAt": "2026-10-20T00:00:00Z", "eventType": "other", "summary": "GitLab security publishes Sigma detections 'Onigmo native worker crash' and 'Org mode render error burst' for self-managed instances.", "sourceIds": [ "tldr-org-render", "tldr-onigmo-crash" ] }, { "id": "gitlab-critical-patch", "occurredAt": "2026-10-21T00:00:00Z", "eventType": "vendor_action", "summary": "GitLab releases 19.5.1, 19.4.3, 19.3.6 and backports 19.2.9, 19.1.9, 19.0.10, 18.11.13 fixing CVE-2026-110264 (CVSS 10.0); GitLab.com already patched.", "sourceIds": [ "gitlab-release" ] }, { "id": "hol-writeup", "occurredAt": "2026-10-21T20:15:10Z", "eventType": "other", "summary": "HOL publishes the operator write-up with upgrade table, log checks and scope notes.", "sourceIds": [ "hol-blog" ] } ], "coverage": [ { "assertionId": "guard-not-server-side", "relationship": "not_covered", "limitation": "HOL Guard reviews AI agent actions on developer machines. It does not sit in front of a GitLab server and does not block this exploit; the fix is the GitLab upgrade." } ], "policies": [], "limitations": [ "GitLab.com is already patched", "GitLab Dedicated tenants on 19.3.5-internal0 / 19.4.2-internal0 or later already include the fix", "GitLab Runner is not named in the advisory", "The 18.11-19.2 backports carry only the critical fix, not the other security fixes in the same release", "Source installs on a self-built Ruby may need the Ruby runtime patch separately", "Absence of crash logs does not rule out a quiet successful exploit" ], "correctionHref": "/guard/security/campaigns/cve-2026-110264-gitlab-onigmo-regex-unauthenticated-rce/corrections" }