2026-016: Critical Vulnerability in GitLab CE and EE
GitLab patches critical CVE-2026-97229 (CVSS 10.0) allowing unauthenticated RCE via CI/CD regex compiler, plus 23 other security issues in CE/EE versions.
GitLab released versions 19.4.2, 19.3.4, and 19.2.8 fixing 24 security issues including CVE-2026-97229 (CVSS 10.0), a critical vulnerability in the CI/CD regular expression compiler that allows unauthenticated arbitrary code execution via integer overflow from crafted regex input. The release also patches CVE-2026-92883 (XSS in syntax highlighting, CVSS 8.7), CVE-2026-16301 (authorization bypass for protected branch pipelines, CVSS 8.5), and 21 other issues including a cache poisoning bug rated 8.2 exposing protected CI/CD variables. CERT-EU strongly recommends upgrading self-managed GitLab CE/EE instances immediately, starting with internet-facing deployments.
- CVE-2026-97229 (CVSS 10.0) enables unauthenticated RCE via CI/CD regex integer overflow
- 24 total security issues fixed across versions 19.4.2, 19.3.4, 19.2.8
- Additional flaws include XSS CVE-2026-92883 (8.7) and auth bypass CVE-2026-16301 (8.5)
- CERT-EU recommends immediate upgrade of self-managed instances, prioritizing internet-facing ones
Vulnerabilities mentionedAll →
- CVE-2026-9722910.0<1%Unauthenticated RCE in GitLab CE/EE via CI/CD regexpublished · GitLab CE/EE PoC ×3+2 related
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-97229 |
Full article234 words · extracted from cert.europa.eu · click to collapse
Release Date: 12-10-2026 12:57:02
History:
- 12/10/2026 --- v1.0 -- Initial publication
Summary
On 12 October 2026, GitLab released versions 19.4.2, 19.3.4 and 19.2.8 of GitLab Community Edition (CE) and Enterprise Edition (EE), fixing 24 security issues among which a critical vulnerability that could allow an unauthenticated attacker to execute arbitrary code on the server [1].
CERT-EU strongly recommends upgrading self-managed GitLab CE/EE instances to a fixed version as soon as possible, starting with internet-facing instances.
Technical Details
The vulnerability CVE-2026-97229, with a CVSS score of 10.0, is located in the CI/CD regular expression compiler [1]. Weak validation of regular expressions leads to an integer overflow, and a specially crafted expression in a CI/CD configuration can then trigger code execution [1].
The same release also fixes other vulnerabilities [1]:
- CVE-2026-92883 (CVSS: 8.7): a cross-site scripting flaw in syntax highlighting that lets an authenticated user run arbitrary JavaScript in other users' browsers through a crafted repository [1].
- CVE-2026-16301 (CVSS: 8.5): an authorisation flaw that lets a developer run pipelines on protected branches without permission [1].
- 21 further issues, including a cache poisoning bug rated 8.2 that could expose protected CI/CD variables [1].
Affected Products
The vulnerabilities affect the following versions of self-managed GitLab CE/EE instances [1]:
- before 19.4.2
- before 19.3.4
- before 19.2.8
Recommendations
CERT-EU strongly recommends upgrading all self-managed GitLab CE/EE instances to a fixed version, starting with internet-facing instances [1].
References
[1] https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/
Text extracted automatically; images, tables and formatting may be missing. Original: https://cert.europa.eu/publications/security-advisories/2026-016/