CVE-2026-97229: Critical GitLab RCE

GitLab has issued an urgent patch for CVE-2026-97229, a maximum severity integer overflow vulnerability residing in its CI/CD Regular Expression Compiler. Left unaddressed, the security flaw allows unauthenticated attackers to execute arbitrary code and gain complete control over self-managed GitLab servers.

Classified with a max severity score, the flaw demands immediate attention. GitLab strongly advises administrators to update affected self-managed installations to the latest patched releases as soon as possible. GitLab.com instances have already been secured, and GitLab Dedicated environments require no further action.

What Is CVE-2026-97229?

CVE-2026-97229 (CVSS 10.0) is an integer overflow or wraparound vulnerability (CWE-190) in GitLab’s CI/CD Regular Expression Compiler. GitLab says that, under certain conditions, insufficient validation of a specially crafted regular expression in a CI/CD configuration can result in unauthenticated arbitrary code execution on the GitLab server.

The published CVSS vector is:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

This indicates network reachability, low attack complexity, no required privileges or user interaction, and potentially high confidentiality, integrity, and availability impact.

GitLab credited security researcher Johan Carlsson (joaxcar), who reported the flaw through its HackerOne bug bounty program. The vendor has not yet disclosed the exact vulnerable function, request path, or complete exploit chain.

Which GitLab Versions Are Affected?

The vulnerability affects:

GitLab’s critical patch release for versions 19.4.2, 19.3.5, and 19.2.8 applies to all deployment types unless otherwise specified.

Some early reporting referenced 19.3.4 as the fix. GitLab now recommends 19.3.5 because 19.3.4 introduced a separate issue affecting merge request pages when the Ona integration was enabled.

Why Is CVE-2026-97229 Critical?

Successful exploitation can provide command execution in the GitLab server context.

Depending on the deployment, this could expose source code, CI/CD variables, access tokens, project data, registries, or credentials accessible to GitLab. A compromised instance could also create risk for connected runners, cloud environments, and deployment systems.

These are potential downstream consequences of server compromise, not evidence that they have occurred in attacks involving CVE-2026-97229.

Is CVE-2026-97229 Being Exploited?

No confirmed in-the-wild exploitation has been reported as of October 13, 2026.

Public exploit claims exist, but a reliable working proof-of-concept (PoC) is not yet confirmed.

Powered by SOCRadar’s Cyber Threat Intelligence module, Vulnerability Intelligence can help teams monitor CVE-2026-97229 for exploit developments, exploitation status, vendor updates, and remediation information. Combined with Attack Surface Management and internal asset inventories, teams can prioritize externally reachable self-managed GitLab instances while monitoring whether public exploit activity develops.

What Should Defenders Do?

Upgrade Immediately

Upgrade affected self-managed GitLab CE and EE installations to 19.2.8, 19.3.5, 19.4.2, or a later supported release.

Verify the running version after deployment, including container and Helm-based installations. GitLab’s Helm chart uses separate chart version numbers, so confirm the underlying GitLab application version rather than relying only on the chart tag.

Reduce Exposure

No vendor-supported workaround replaces upgrading.

Until patching is complete, restrict unnecessary public access to GitLab, segment application servers from sensitive CI/CD infrastructure, and limit connectivity to runners, registries, cloud environments, and internal services.

Hunt for Suspicious Activity

GitLab has not published CVE-specific indicators. Defenders can review:

• Unusual unauthenticated requests associated with CI/CD configuration processing.
• Unexpected processes or child processes launched by GitLab services.
• New users, tokens, deploy keys, runners, hooks, or integrations.
• Unexpected pipeline or repository changes.
• Unusual outbound connections from GitLab servers.
• Suspicious access to CI/CD variables, credentials, or deployment secrets.

These are hunting hypotheses rather than confirmed indicators of CVE-2026-97229 exploitation.

If suspicious server side execution is identified, preserve logs and investigate credentials, tokens, runners, cloud integrations, and other secrets accessible to the GitLab instance before closing the incident.