GitLab Checker.
GitLab fixed a critical flaw that lets an unauthenticated visitor run code on a self-managed server (CVSS 10.0). Check which GitLab release your instance runs and whether it is before the fix.
Passive check on instances you own. It reads the public sign-in page like a browser, never logs in and never sends an exploit. Fixed in GitLab 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13 (GitLab, 21 Oct 2026); every earlier release is affected.
Why CVE-2026-110264 Matters.
Your Source Code Server Is A Prime Target
GitLab holds source code, build secrets and deploy keys. Code execution on that server hands an attacker the keys to everything it builds and ships, which is why CVE-2026-110264 is rated CVSS 10.0.
No Login Needed To Attack
GitLab says the flaw can be reached by an unauthenticated user. GitLab published the fixes on 21 October 2026 in 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13, and a public fix gives attackers something to study, so the window to upgrade is short.
Hidden Does Not Mean Patched
GitLab does not show its version to anonymous visitors, and a firewall or custom build can hide more. Check the real version as an administrator rather than assuming a quiet page means a safe server.
Only Self-Managed Instances Are At Risk
GitLab.com and GitLab Dedicated are already patched. Self-managed instances are run by your own team, so the upgrade is yours to do, and branches older than 18.11 get no backport.
How The Check Works.
- 01
Enter Your Instance
Type the domain, IP, or URL of a GitLab you run. The check reaches the public sign-in page exactly as a browser would.
- 02
Run The Check
We read the names of the files the sign-in page loads and match them with the official GitLab releases, then compare the release with the CVE-2026-110264 fix. No login, no API token, no exploit.
- 03
Read The Verdict
See the release we recognised, whether it is before the fix of its branch, and a clear next step. If the release cannot be read we say so plainly and tell you where to look.
FAQ
Common Questions.
CVE-2026-110264 is an integer overflow in GitLab's regular expression compiler, rated CVSS 10.0. GitLab says that under certain conditions an unauthenticated user could execute arbitrary code on the GitLab server. It affects GitLab CE and EE, from 7.0 up to the fixed releases. GitLab.com and GitLab Dedicated are already patched; the risk is for self-managed instances.
All versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3 and 19.5 before 19.5.1. GitLab published the fixes on 21 October 2026 in 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13. Branches older than 18.11 get no backport, so those instances need a full upgrade.
GitLab does not print its version to anonymous visitors. But the public sign-in page loads script files whose names change with every release. This check reads those names, as a browser would, and compares them with the same names from the official GitLab images. When the names match one release, the check tells you which one. When they match no release in its table, it says the version is not readable instead of guessing.
It makes ordinary GET requests for the public sign-in page of the address you enter (HTTPS first, HTTP if that fails). If you enter a bare domain and nothing on it is GitLab, it also looks at gitlab., git., code. and scm. in front of that domain. It never logs in, never uses an API token, never sends an exploit or a crafted pattern, and only reads what any visitor's browser receives. Only check instances you are authorised to test.
No. A GitLab behind a firewall, a custom build or a release newer than the check's table cannot be placed, and this tool cannot confirm exploitability. A hidden version is not a patched version. Sign in as an administrator and open Admin > Overview, or run gitlab-rake gitlab:env:info on the server, and compare the version with the fixed releases.
GitLab lists no workaround for CVE-2026-110264, and the vendor's own guidance is to upgrade to the fixed release of your branch. Until then, keep the instance off the open internet if you can, for example behind a VPN or an IP allow list. GitLab also published two threat detections for self-managed customers, so ask your security team to enable them.
A host below 19.2.8, 19.3.5 or 19.4.2 also missed the fix for CVE-2026-97229 (12 October 2026). Upgrading to the current patch of your branch closes both flaws.
Related checks: PHP2Shell checker and WordPress checker.
One Instance Checked. See Your Whole Edge.
This tool reads one GitLab's release. The Brandefense platform inventories every internet-facing system you run, flags new CVEs as they land, and keeps watch over your external attack surface without a break.
Request A Demo