CISA has added CVE-2026-97229, a maximum-severity code execution flaw in self-managed GitLab, to its Known Exploited Vulnerabilities (KEV) catalog. The bug lets an unauthenticated attacker run code on a GitLab server through a crafted CI/CD configuration, and a fix has been available since October 12. Any instance still on an older release should be treated as urgent.
What happened
GitLab disclosed CVE-2026-97229 on October 12 as an integer overflow in the regular expression compiler used for CI/CD. In its advisory, GitLab says that under certain conditions an unauthenticated user could execute arbitrary code on the server through a specially crafted regular expression in a CI/CD configuration. The score is CVSS 10.0, and the researcher joaxcar reported it through HackerOne.
Public technical detail followed quickly. Daily Security Review reported on October 14 that Rapid7 had published a write-up and proof-of-concept, and that Censys counted about 25,766 internet-facing GitLab hosts on vulnerable versions. We have not independently checked the Rapid7 material or the Censys figure.
The new development is exploitation. The Hacker News reports that CISA added the flaw to KEV on October 29, alongside a Cisco ASA and FTD bug, and cites Alpine Linux’s own incident disclosure. According to that account, an unknown actor sent crafted CI configurations to Alpine’s unpatched GitLab on October 20 and 21, crashing worker processes eight times; four of those crashes failed at the next stage of the exploit. Later attempts on October 25 and 26 were blocked, and the attacker also downloaded Alpine’s GitLab container image. Alpine said it found no evidence the exploit succeeded but could not rule it out, so it rebuilt the instance from scratch.
Who is affected
Self-managed GitLab Community and Enterprise Edition installations running 19.2 before 19.2.8, 19.3 before 19.3.5, or 19.4 before 19.4.2. GitLab says GitLab.com already runs the patched version and that GitLab Dedicated was patched before the advisory went out. Note that BleepingComputer listed the 19.3 fix as 19.3.4; we followed GitLab’s own advisory, which says 19.3.5.
What to do
- Upgrade to 19.2.8, 19.3.5 or 19.4.2, depending on your branch. GitLab warns the release includes database migrations, and single-node installs will see downtime while they finish.
- GitLab publishes six detections for self-managed instances, including signals for regex-engine worker crashes and rejected CI regex guards. Check your logs for them.
- Our analysis: if you ran an affected version exposed to the internet between October 12 and your patch date, review CI lint and worker-crash logs, and consider rotating CI/CD secrets and tokens if anything looks off. Alpine chose to rebuild rather than trust a possibly compromised host.
- Our analysis: where you cannot patch immediately, restrict who can reach the instance, since the attack path runs through CI configuration handling.
The Hacker News says federal civilian agencies are advised to apply fixes by November 1. We could not read CISA’s own alert page, so that date comes from the news report.
What we still do not know
The identity of the attacker is unknown, and so is whether any other organization was compromised. The reports describe the Alpine attempts, not successful intrusions elsewhere, and CISA’s alert does not appear to say how widely the flaw is being used. GitLab’s advisory also does not itself mention in-the-wild exploitation.
Sources: GitLab critical patch release 19.4.2, 19.3.5, 19.2.8 (Oct 12, 2026); The Hacker News, CISA adds GitLab RCE and Cisco firewall flaws to KEV (Oct 30, 2026); BleepingComputer (Oct 12, 2026); Daily Security Review (Oct 14, 2026); CISA alert (Oct 29, 2026).
Leave a Reply