REPORTED DEVELOPMENT
GitLab released fixes for CVE-2026-110264, CVSS 10.0 Critical, which can permit unauthenticated code execution under specified conditions in vulnerable self-managed Community and Enterprise editions. Seven release branches received fixes. CERT-EU confirmed severity on 22 October and recommended priority patching and checks for potentially compromised environments. GitLab says managed infrastructure is already updated.
WHY IT MATTERS TO THE MARKET
Software repositories and delivery pipelines can be exposed through their supporting infrastructure; applicability depends on actual use of vulnerable self-managed versions.