NewsCompaniesFlawsGuides
Get the app
CriticalFixedBeing used in attacksUpdated

GitLab CE/EE critical remote code execution flaw CVE-2026-97229 exploited in attacks; update to 19.4.2, 19.3.5 or 19.2.8

GitLab's CVSS 10 flaw CVE-2026-97229 lets anyone run code on a self-managed GitLab server without logging in, and CISA says it's being exploited. Fixed in 19.4.2, 19.3.5 and 19.2.8. If you run your own GitLab, update now. GitLab.com is already patched.

What to do

If you or your business run your own GitLab server, update it to 19.4.2, 19.3.5 or 19.2.8 (or later) now, and ask your IT provider to check for signs of attack. If you use GitLab.com, there is nothing to do, as it is already patched.

What’s happening

CVE-2026-97229 is a maximum-severity flaw (CVSS 10.0) in the CI/CD regular expression compiler of GitLab Community Edition and Enterprise Edition. An unauthenticated attacker can send a specially crafted regular expression in a CI/CD configuration and run their own code on the GitLab server. GitLab fixed it on 12 October 2026 in versions 19.4.2, 19.3.5 and 19.2.8; affected versions are 19.2 before 19.2.8, 19.3 before 19.3.5 and 19.4 before 19.4.2. GitLab.com and GitLab Dedicated were already patched, so the risk is to self-managed installations. On 29 October CISA added the flaw to its catalogue of vulnerabilities being used in attacks, and GitLab said it had detected exploitation attempts and released detections for self-managed instances. On 23 October Ruby separately released fixes for the underlying regular expression bugs in 4.0.9, 3.4.12 and 3.3.13. Shadowserver tracks nearly 2,800 internet-exposed GitLab Community Edition instances, with no patch figure given. A fix exists for every affected branch.

What
Flaw
Affects
GitLab Community Edition and Enterprise Edition (self-managed)
Affected
GitLab CE/EE 19.2 before 19.2.8
GitLab CE/EE 19.3 before 19.3.5
GitLab CE/EE 19.4 before 19.4.2
Fixed in
19.2.8
19.3.5
19.4.2
CVE
CVE-2026-97229
Since
12 Oct 2026

Timeline

  1. Update

    BleepingComputer reported that Shadowserver tracks nearly 2,800 internet-exposed GitLab Community Edition instances, and did not say how many were patched. US federal agencies were told to secure their servers under a CISA deadline, which one report gives as 1 November.

  2. CISA added

    CISA added CVE-2026-97229 to its Known Exploited Vulnerabilities catalog, confirming attacks in the wild. GitLab reported detecting exploitation attempts and published threat detections for self-managed instances.

  3. Update

    Ruby released 4.0.9, 3.4.12 and 3.3.13 with fixes for the underlying bugs in its Onigmo regular expression engine, which GitLab had assigned four CVEs, including CVE-2026-97229. Ruby said only applications that compile patterns from attacker-controlled text are affected.

  4. Made publicFixed

    GitLab released patch versions 19.4.2, 19.3.5 and 19.2.8 for Community and Enterprise Edition, fixing CVE-2026-97229, a CVSS 10.0 flaw in the CI/CD regular expression compiler that let an unauthenticated attacker run code on the server. GitLab.com and GitLab Dedicated were already patched, and GitLab urged self-managed administrators to upgrade immediately.

Sources

  1. GitLab Patch Release: 19.4.2, 19.3.5, 19.2.8GitLab · 12 Oct 2026
  2. Regexp fixes for GitLab CVEsRuby · 23 Oct 2026
  3. CISA says max severity GitLab flaw now exploited in the wildBleepingComputer · 30 Oct 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from October 2026 · JSON · RSS