CVE-2026-97229: Critical Unauthenticated GitLab RCE

Are You Affected?

CVE-2026-97229 affects self-managed GitLab CE and EE. The vulnerability involves insufficient validation of specially crafted regular expressions processed during CI/CD configuration handling. Under certain conditions, an unauthenticated attacker can trigger arbitrary code execution on the GitLab server.

Use the following version ranges to determine exposure:

Installations on versions earlier than the listed branches should be assessed against the vendor’s current supported-release guidance. The affected ranges documented for this CVE are the 19.2, 19.3, and 19.4 branches shown above.

Do not assume an instance is safe merely because it is not internet-facing. GitLab commonly stores source code, deployment credentials, CI/CD variables, access tokens, runner registration data, and webhook secrets.

Self-managed administrators should inventory every GitLab installation, including standalone instances, high-availability deployments, disaster-recovery environments, container images, and test systems. If asset inventory is incomplete, treat unknown GitLab installations as potentially affected until their exact versions are verified.

For related security terminology, see our incident response plan glossary before beginning a formal investigation.

The Fix, If You’re in a Hurry

Upgrade immediately to the applicable fixed release:

• GitLab 19.2.x: upgrade to 19.2.8 or later.
• GitLab 19.3.x: upgrade to 19.3.5 or later.
• GitLab 19.4.x: upgrade to 19.4.2 or later.

GitLab’s critical patch release was issued on October 12, 2026. The vendor recommends that self-managed installations upgrade without waiting for a normal maintenance cycle. Use the official GitLab package and upgrade documentation for your operating system, deployment method, and topology.

For Omnibus GitLab installations, a representative upgrade sequence is:

sudo apt-get update
sudo apt-get install gitlab-ee=19.4.2-ee.0
sudo gitlab-ctl reconfigure
sudo gitlab-ctl restart
sudo gitlab-rake gitlab:check SANITIZE=true

For Community Edition, use the corresponding gitlab-ce package. The exact package suffix and repository configuration vary by distribution and GitLab edition, so confirm the package version available in your configured GitLab repository before executing the change. Containerized deployments should update the image tag to the applicable fixed release and recreate the application containers according to the deployment documentation.

If an immediate upgrade is not possible, restrict access to the GitLab service using network controls, remove unnecessary internet exposure, and allow access only from trusted administrative and development networks. These controls are temporary compensating measures, not a substitute for patching. Because the vulnerability is unauthenticated and actively exploited, do not rely on authentication policy changes alone.

Technical Notes

Before upgrading, record the installed version and deployment type:

sudo gitlab-rake gitlab:env:info
sudo dpkg-query -W gitlab-ee 2>/dev/null || sudo rpm -q gitlab-ee
sudo dpkg-query -W gitlab-ce 2>/dev/null || sudo rpm -q gitlab-ce

After the upgrade, verify the running version and service health:

sudo gitlab-rake gitlab:env:info
sudo gitlab-ctl status
sudo gitlab-rake gitlab:check SANITIZE=true

Do not destroy the original host, logs, or container layers before determining whether exploitation occurred. If there are indicators of compromise, preserve evidence and coordinate the upgrade with incident response personnel.

Analyst’s Take: Patch first, then investigate from preserved evidence. CISA KEV establishes exploitation in the wild, while the public Rapid7 research shows technical reproduction against an unpatched 19.4.1 image; neither source provides a complete account of activity against every deployment.

How This Vulnerability Works

CVE-2026-97229 is classified as an integer overflow or wraparound vulnerability under CWE-190. The reported root cause is insufficient validation of specially crafted regular expressions handled by GitLab’s CI/CD regular-expression compiler or related configuration-processing logic.

At a high level, the attack path involves introducing a malicious CI/CD configuration containing a specially crafted regular expression and causing GitLab to process it. Under vulnerable conditions, an integer calculation can overflow or wrap around, allowing validation or compilation logic to behave unsafely. The resulting condition can enable attacker-controlled code execution on the GitLab server.

The precise exploit mechanics should be taken from GitLab’s advisory and the technical research referenced below rather than inferred from the CVSS vector alone. The operational consequence is clear: successful exploitation can provide control of the GitLab application context and potentially the underlying host, depending on deployment permissions and local hardening.

The lack of authentication and user interaction is especially important. A victim does not need to approve a project change or open a malicious file for exploitation to matter. An exposed self-managed GitLab instance may therefore be attacked directly over the network.

Once code execution is obtained, attackers may target repositories, CI/CD variables, runners, access tokens, deployment keys, cloud credentials, and other systems reachable from the GitLab environment.

Technical Notes

The affected functionality is associated with CI/CD configuration processing and regular-expression handling. Defenders should pay particular attention to recently changed .gitlab-ci.yml files, pipeline definitions, project settings, and unusual configuration changes preceding suspicious server activity.

The vulnerability is not described as a simple client-side issue. Patching the browser, Git client, or runner alone does not remediate the vulnerable GitLab server. The GitLab application and any redundant or standby instances must be upgraded.

Severity, Explained

The CVSS v3.1 base score is 10.0 Critical, with the following vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Each component has direct operational significance:

• AV:N, Network: The attack can be delivered over a network.
• AC:L, Low: Exploitation does not require unusual conditions or complex preparation.
• PR:N, None: The attacker does not need a GitLab account or existing privileges.
• UI:N, None: No separate victim action is required.
• S:C, Changed: Exploitation can affect security authority beyond the initially vulnerable component.
• C:H, I:H, A:H: Confidentiality, integrity, and availability impacts can all be high.

The score does not mean that every GitLab host will automatically be fully compromised. Actual impact depends on the GitLab deployment’s privileges, network reachability, runner configuration, secrets, segmentation, and host controls. It does mean that the vulnerability’s exploit prerequisites are minimal and that the potential consequences are severe.

CISA added CVE-2026-97229 to the Known Exploited Vulnerabilities Catalog on October 29, 2026, with a remediation due date of November 1, 2026. The listed ransomware-campaign field is unknown. That field does not reduce the urgency: KEV inclusion confirms exploitation in the wild even though no named ransomware campaign has been identified.

Is It Being Exploited?

Yes. CVE-2026-97229 is listed in the CISA Known Exploited Vulnerabilities Catalog. That designation is the basis for stating that exploitation has been confirmed in the wild. Organizations should therefore treat exposed vulnerable GitLab instances as potentially targeted, not merely theoretically exploitable.

No named ransomware campaign is identified in the available information. CISA records known ransomware use as unknown. Administrators should avoid conflating the absence of a named campaign with the absence of attacker activity. Exploitation may support credential theft, source-code theft, persistence, supply-chain compromise, or access to connected environments without producing a ransomware event.

Public technical exploit research is also available. The NVD record references Rapid7 Metasploit Framework pull request 22017, and Rapid7 reported reproducing arbitrary code execution against an unpatched GitLab CE 19.4.1 image while the same input did not work against patched 19.4.2. This establishes a public technical reproduction and exploit reference.

The available evidence does not establish that a fully weaponized Metasploit module was merged or released, so defenders should describe the status as public exploit research or a PoC reference rather than claim a released module without verification.