Skip to content
NewA calmer, faster ZeroHour
Exploit / PoCcriticalExploited in the wild

CISA KEV lists GitLab unauthenticated RCE CVE-2026-97229

Original title: CISA KEV: GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability — GitLab Community Edition and Enterprise Edition (CVE-2026-97229)

CISA Known Exploited Vulnerabilities ()1 min read1
Read at cisa.gov
Part of a story covered by 8 sourcesCISA flags exploited GitLab regex flaw after Alpine probeMerged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

A crafted regular expression in CI/CD configuration can run arbitrary code; the federal due date is November 1, 2026.

CISA added CVE-2026-97229, an integer overflow or wraparound in GitLab Community Edition and Enterprise Edition, to the Known Exploited Vulnerabilities catalog. Insufficient regular-expression validation could let an unauthenticated user execute arbitrary code on the GitLab server through a specially crafted regular expression in a CI/CD configuration. Required action is to apply vendor mitigations under BOD 26-04 by November 1, 2026, or discontinue use if mitigations are unavailable. Known ransomware use is unknown.

Unconfirmed: CISA lists known ransomware campaign use as unknown and gives no version ranges.

Key facts
  • Both Community Edition and Enterprise Edition are named.
  • The flaw is tied to CI/CD regular-expression validation.
  • Catalog due date is November 1, 2026.
  • No fixed versions are stated.
Security assessment · AI, from the articleExploited in the wild

Impact: Unauthenticated arbitrary code execution on the GitLab server

ProductAffected
GitLab Community Edition—
GitLab Enterprise Edition—
What to do
  1. 1.Apply vendor mitigations and follow CISA BOD 26-04 by November 1, 2026.
  2. 2.Discontinue use of the product if mitigations are unavailable.
  3. 3.Check internet exposure and follow CISA forensics triage requirements.
Analyze CVE-2026-97229 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-97229
ATT&CK
T1190 Exploit Public-Facing Application
Tags
gitlabkevremote-code-executionci-cdinteger-overflow
Vendors
GitLab
Products
GitLab Community EditionGitLab Enterprise Edition
Organizations
CISA

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-97229
Unauthenticated RCE in GitLab CE/EE via CI/CD regex
10.018%KEVPoC ×5
KEV

From the original article

1 min read at cisa.gov

GitLab Community Edition and Enterprise Edition contain a integer overflow or wraparound vulnerability that could allow an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.

CISA Known Exploited Vulnerabilities

cisa.gov

Read the full article at CISA Known Exploited Vulnerabilities

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.