GitLab patched CVE-2026-97229, a CVSS 10.0 unauthenticated RCE in self-managed servers.
GitLab released an urgent patch for CVE-2026-97229, a CVSS 10.0 integer overflow in the CI/CD Regular Expression Compiler. Unpatched, the flaw lets unauthenticated attackers execute arbitrary code and take over self-managed GitLab servers. GitLab.com has already been secured, and GitLab Dedicated customers need no further action.
CVE-2026-97229 is a CVSS 10.0 integer overflow in GitLab's CI/CD regex compiler.
Unauthenticated attackers could run arbitrary code on self-managed GitLab servers.
GitLab.com is already patched; GitLab Dedicated needs no customer action.
Administrators should update self-managed installations immediately.
GitLab remediated a critical flaw in GitLab Community Edition and Enterprise Edition in which insufficient validation of a regular expression in CI/CD configuration can let an unauthenticated remote attacker run arbitrary code on the GitLab server under certain conditions. The issue is triggered by a specially crafted regular expression supplied through CI/CD configuration and does not require a logged-in user. Successful exploitation yields full confidentiality, integrity, and availability impact on the server, with a changed scope (CVSS 3.1 10.0). It affects all 19.2 releases before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. It is not listed in CISA KEV and no public proof-of-concept is known.
Do: Upgrade self-managed GitLab CE/EE to 19.2.8, 19.3.5, or 19.4.2 (or any later release on a supported line). Until patched, keep the instance off the public internet, restrict who can reach the web UI and API, and review recent CI/CD configuration changes for unexpected regular expressions.
10.0
<1%
PoC ×3
GitLab CE/EE 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2
largeon the order of 10,000–50,000 self-managed GitLab servers (estimate; only unpatched 19.2/19.3/19.4)
GitLab has issued an urgent patch for CVE-2026-97229, a maximum severity integer overflow vulnerability residing in its CI/CD Regular Expression Compiler. Left unaddressed, the security flaw allows unauthenticated attackers to execute arbitrary code and gain complete control over self-managed GitLab servers.
Classified with a max severity score, the flaw demands immediate attention. GitLab strongly advises administrators to update affected self-managed installations to the latest patched releases as soon as possible. GitLab.com instances have already been secured, and GitLab Dedicated environments require no further action.
What Is CVE-2026-97229?
CVE-2026-97229 (CVSS 10.0) is an integer overflow or wraparound vulnerability (CWE-190) in GitLab’s CI/CD Regular Expression Compiler. GitLab says that, under certain conditions, insufficient validation of a specially crafted regular expression in a CI/CD configuration can result in unauthenticated arbitrary code execution on the GitLab server.
The published CVSS vector is:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
This indicates network reachability, low attack complexity, no required privileges or user interaction, and potentially high confidentiality, integrity, and availability impact.
Details of CVE-2026-97229 (SOCRadar Vulnerability Intelligence)
GitLab credited security researcher Johan Carlsson (joaxcar), who reported the flaw through its HackerOne bug bounty program. The vendor has not yet disclosed the exact vulnerable function, request path, or complete exploit chain.
Some early reporting referenced 19.3.4 as the fix. GitLab now recommends 19.3.5 because 19.3.4 introduced a separate issue affecting merge request pages when the Ona integration was enabled.
Why Is CVE-2026-97229 Critical?
Successful exploitation can provide command execution in the GitLab server context.
Depending on the deployment, this could expose source code, CI/CD variables, access tokens, project data, registries, or credentials accessible to GitLab. A compromised instance could also create risk for connected runners, cloud environments, and deployment systems.
These are potential downstream consequences of server compromise, not evidence that they have occurred in attacks involving CVE-2026-97229.
Is CVE-2026-97229 Being Exploited?
No confirmed in-the-wild exploitation has been reported as of October 13, 2026.
Public exploit claims exist, but a reliable working proof-of-concept (PoC) is not yet confirmed.
SOCRadar’s Vulnerability Intelligence
Powered by SOCRadar’s **Cyber Threat Intelligence**module, Vulnerability Intelligence can help teams monitor CVE-2026-97229 for exploit developments, exploitation status, vendor updates, and remediation information. Combined with Attack Surface Management and internal asset inventories, teams can prioritize externally reachable self-managed GitLab instances while monitoring whether public exploit activity develops.
What Should Defenders Do?
Upgrade Immediately
Upgrade affected self-managed GitLab CE and EE installations to 19.2.8, 19.3.5, 19.4.2, or a later supported release.
Verify the running version after deployment, including container and Helm-based installations. GitLab’s Helm chart uses separate chart version numbers, so confirm the underlying GitLab application version rather than relying only on the chart tag.
Reduce Exposure
No vendor-supported workaround replaces upgrading.
Until patching is complete, restrict unnecessary public access to GitLab, segment application servers from sensitive CI/CD infrastructure, and limit connectivity to runners, registries, cloud environments, and internal services.
Hunt for Suspicious Activity
GitLab has not published CVE-specific indicators. Defenders can review:
Unusual unauthenticated requests associated with CI/CD configuration processing.
Unexpected processes or child processes launched by GitLab services.
New users, tokens, deploy keys, runners, hooks, or integrations.
Unexpected pipeline or repository changes.
Unusual outbound connections from GitLab servers.
Suspicious access to CI/CD variables, credentials, or deployment secrets.
These are hunting hypotheses rather than confirmed indicators of CVE-2026-97229 exploitation.
If suspicious server side execution is identified, preserve logs and investigate credentials, tokens, runners, cloud integrations, and other secrets accessible to the GitLab instance before closing the incident.
PROTECTION OF PERSONAL DATA****COOKIE POLICY FOR THE INTERNET SITE
Protecting your personal data is one of the core principles of our organization, SOCRadar, which operates the internet site (www.socradar.com). This Cookie Usage Policy (“Policy”) explains the types of cookies used and the conditions under which they are used to all website visitors and users.
Cookies are small text files stored on your computer or mobile device by the websites you visit.
Cookies are commonly used to provide you with a personalized experience while using a website, enhance the services offered, and improve your overall browsing experience, contributing to ease of use while navigating a website. If you prefer not to use cookies, you can delete or block them through your browser settings. However, please be aware that this may affect your usage of our website. Unless you change your cookie settings in your browser, we will assume that you accept the use of cookies on this site.
1. WHAT KIND OF DATA IS PROCESSED IN COOKIES?
Cookies on websites collect data related to your browsing and usage preferences on the device you use to visit the site, depending on their type. This data includes information about the pages you access, the services and products you explore, your preferred language choice, and other preferences.
2. WHAT ARE COOKIES AND WHAT ARE THEIR PURPOSES?
Cookies are small text files stored on your device or web server by the websites you visit through your browsers. These small text files, containing your preferred language and other settings, help us remember your preferences on your next visit and assist us in making improvements to our services to enhance your experience on the site. This way, you can have a better and more personalized user experience on your next visit.
The main purposes of using cookies on our Internet Site are as follows:
Improve the functionality and performance of the website to enhance the services provided to you,
Enhance and introduce new features to the Internet Site and customize the provided features based on your preferences,
Ensure legal and commercial security for the Internet Site, yourself, and the Organization, and prevent fraudulent transactions through the Site,
Fulfill legal and contractual obligations, including those arising from Law No. 5651 on the Regulation of Publications on the Internet and the Fight Against Crimes Committed Through These Publications, as well as the Regulation on the Procedures and Principles Regarding the Regulation of Publications on the Internet.
3. TYPES OF COOKIES USED ON OUR INTERNET SITE****3.1. Session Cookies
Session cookies ensure the smooth operation of the internet site during your visit. They are used for purposes such as ensuring the security and continuity of our sites and your visits. Session cookies are temporary cookies and are deleted when you close your browser; they are not permanent.
3.2. Persistent Cookies
These cookies are used to remember your preferences and are stored on your device through browsers. Persistent cookies remain stored on your device even after you close your browser or restart your computer. These cookies are stored in your browser’s subfolders until deleted from your browser’s settings. Some types of persistent cookies can be used to provide personalized recommendations based on your usage purposes.
With persistent cookies, when you revisit our website with the same device, the website checks if a cookie created by our website exists on your device. If so, it is understood that you have visited the site before, and the content to be presented to you is determined accordingly, offering you a better service.
3.3. Mandatory/Technical Cookies
Mandatory cookies are essential for the proper functioning of the visited internet site. The purpose of these cookies is to provide necessary services by ensuring the operation of the site. For example, they allow access to secure sections of the internet site, use of its features, and navigation.
3.4. Analytical Cookies
These cookies gather information about how the website is used, the frequency and number of visits, and show how visitors navigate to the site. The purpose of using these cookies is to improve the operation of the site, increase its performance, and determine general trend directions. They do not contain data that can identify visitors. For example, they show the number of error messages displayed or the most visited pages.
3.5. Functional Cookies
Functional cookies remember the choices made by visitors within the site and recall them during the next visit. The purpose of these cookies is to provide ease of use to visitors. For example, they prevent the need to re-enter the user’s password on each page visited by the site user.
3.6. Targeting/Advertising Cookies
They measure the effectiveness of advertisements shown to visitors and calculate how many times ads are displayed. The purpose of these cookies is to present personalized advertisements to visitors based on their interests.
Similarly, they determine the specific interests of visitors’ navigation and present appropriate content. For example, they prevent the same advertisement from being shown again to the visitor in a short period.
4. HOW TO MANAGE COOKIE PREFERENCES?
To change your preferences regarding the use of cookies, block or delete cookies, you only need to change your browser settings.
Many browsers offer options to accept or reject cookies, only accept certain types of cookies, or receive notifications from the browser when a website requests to store cookies on your device.
Also, it is possible to delete previously saved cookies from your browser.
If you disable or reject cookies, you may need to manually adjust some preferences, and certain features and services on the website may not work properly as we will not be able to recognize and associate with your account. You can change your browser settings by clicking on the relevant link from the table below.
5. EFFECTIVE DATE OF THE INTERNET SITE PRIVACY POLICY
The Internet Site Privacy Policy is dated The effective date of the Policy will be updated if the entire Policy or specific sections are renewed. The Privacy Policy is published on the Organization’s website (www.socradar.com) and made accessible to relevant individuals upon request.
SOCRadar
Address: 651 N Broad St, Suite 205 Middletown, DE 19709 USA
Phone: +1 (571) 249-4598
Email: info@socradar.io
Website: www.socradar.com
Extended Threat Intelligence Threat intelligence enriched with External Attack Surface Management, Brand Protection, and Dark Web Radar. Explore XTIAgentic Threat Intelligence Stay ahead of cybercriminals with AI agents that autonomously think, adapt, and act. Explore ATI Advanced Dark Web Monitoring
Dark Web Report
