Story · 9 sources · 11 articlesfirst Oct 12, 12:58 UTCupdated Oct 16, 13:31 UTC (14h ago)

GitLab patches CVSS 10.0 CI/CD regex flaw CVE-2026-97229

highVulnerabilityimportance 84CVE-2026-97229 CVE-2026-92883 CVE-2026-16301 CVE-2026-14814 CVE-2026-90970 CVE-2026-85706 CVE-2026-81839 CVE-2026-96893

What's new: Rapid7's later October 16 analysis says its proof of concept reliably ran commands as the git user on GitLab CE 19.4.1 with ASLR after a malicious CI configuration was pushed to a public project, that GitLab reported no in-the-wild exploitation, and that GitLab.com was patched before disclosure. It also lists the 19.3 fix as 19.3.5, matching later reports rather than early reports of 19.3.4.

Merged summary · grok-4.7-build · rewritten as coverage arrives

GitLab patched CVSS 10.0 CI/CD regex flaw CVE-2026-97229; sources disagree on the 19.3 fix, and public proofs of concept followed.

On October 12, 2026, GitLab patched CVE-2026-97229, a CVSS 10.0 integer overflow (CWE-190) in the CI/CD regular-expression compiler that can allow arbitrary code execution on self-managed Community and Enterprise Edition servers. Early reports list fixes in 19.2.8, 19.3.4, and 19.4.2, while later reports list 19.2.8, 19.3.5, and 19.4.2. GitLab and several outlets describe unauthenticated execution through crafted regex input in CI/CD configuration; later public proofs of concept, including one by Jonah Burgess and analysis from Rapid7, say a malicious CI configuration must first be pushed, after which commands run as the git account rather than an administrator. CERT-EU said the release fixed 24 issues, including XSS CVE-2026-92883 (CVSS 8.7) and authorization bypass CVE-2026-16301 (8.5); CSO Online also lists cache poisoning CVE-2026-14814 (8.2), CVE-2026-81839 (7.7), and GitLab Duo agent-instruction injection CVE-2026-96893 (7.3). GitLab.com is already patched and Dedicated customers need no action, while self-managed administrators are urged to upgrade immediately, prioritizing internet-facing and self-registration-enabled instances. Rapid7 reproduced the issue on 19.4.1 CE but not on patched 19.4.2, and sources do not report in-the-wild exploitation of CVE-2026-97229, unlike earlier flaw CVE-2026-85706, which CISA listed as exploited.

On October 12, 2026, GitLab patched CVE-2026-97229, a CVSS 10.0 integer overflow (CWE-190) in the CI/CD regular-expression compiler on self-managed Community and Enterprise Edition.
Sources disagree on the 19.3 fix: early reports list 19.2.8, 19.3.4, and 19.4.2; later reports list 19.2.8, 19.3.5, and 19.4.2. Ranges otherwise cited are 19.2 before 19.2.8 and 19.4 before 19.4.2.
GitLab and several outlets call it unauthenticated code execution via crafted CI/CD regex input. Later proofs of concept say a project push is required first, after which the CI lint endpoint can be hit without credentials and commands run…
CERT-EU said 24 issues were fixed, including XSS CVE-2026-92883 (CVSS 8.7) and protected-branch bypass CVE-2026-16301 (8.5). CSO Online also names cache poisoning CVE-2026-14814 (8.2), CVE-2026-81839 (7.7), and GitLab Duo agent-instruction…
GitLab.com is already patched and Dedicated customers need no action. Self-managed administrators are urged to upgrade immediately, especially internet-facing or self-registration-enabled instances.
joaxcar is credited with reporting the bug. Rapid7 reproduced execution on 19.4.1 CE but not on 19.4.2; Jonah Burgess later published a public proof of concept. Sources do not report in-the-wild exploitation of CVE-2026-97229.

VendorsGitLab

ProductsGitLab Community Edition GitLab Enterprise Edition Onigmo GitLab AI Gateway GitLab Duo Duo Agent Platform GitLab GitLab.com GitLab Dedicated GitLab CE GitLab EE

OrganizationsGitLab Rapid7 CISA HackerOne CERT-EU Canadian Centre for Cyber Security

CountriesCanada

Coverage timelineoldest first · each row is one article

Oct 12, 12:58 UTC · 4d ago
CERT-EU Advisories· 78
2026-016: Critical Vulnerability in GitLab CE and EE
GitLab patches critical CVE-2026-97229 (CVSS 10.0) allowing unauthenticated RCE via CI/CD regex compiler, plus 23 other security issues in CE/EE versions.
Oct 12, 13:09 UTC · 4d ago
BleepingComputer· 78
GitLab warns of max severity code execution vulnerability
GitLab patched maximum-severity unauthenticated RCE CVE-2026-97229 in its CI/CD regex compiler.
Oct 12, 14:19 UTC · 4d ago
Cyber Security News· 80
Critical GitLab Vulnerability Enables Arbitrary Code Execution Attacks on Servers

Vulnerabilities in this storyAll →

CVE-2026-07237.4<1%
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 18.6.4, 18.7 before 18.7.2, and 18.8 before 18.8.2 that could have…
published Jan 22, 2026· gitlab gitlab
CVE-2026-9722910.0<1%
Unauthenticated RCE in GitLab CE/EE via CI/CD regex

CVE	Vulnerability	CVSS	EPSS	Flags	Affected	Exposure	Published
CVE-2026-0723	GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 18.6.4, 18.7 before 18.7.2, and 18.8 before 18.8.2 that could have… GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 18.6.4, 18.7 before 18.7.2, and 18.8 before 18.8.2 that could have allowed an individual with existing knowledge of a victim's credential ID to bypass two-factor authentication by submitting forged device responses. NVD description · AI analysis pending	7.4	<1%		gitlab gitlab	—	Jan 22, 2026
CVE-2026-97229 +5 related CVEs CVE-2026-92883 CVE-2026-16301 CVE-2026-14814 CVE-2026-81839 CVE-2026-96893	Unauthenticated RCE in GitLab CE/EE via CI/CD regex GitLab remediated a critical flaw in GitLab Community Edition and Enterprise Edition in which insufficient validation of a regular expression in CI/CD configuration can let an unauthenticated remote attacker run arbitrary code on the GitLab server under certain conditions. The issue is triggered by a specially crafted regular expression supplied through CI/CD configuration and does not require a logged-in user. Successful exploitation yields full confidentiality, integrity, and availability impact on the server, with a changed scope (CVSS 3.1 10.0). It affects all 19.2 releases before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. It is not listed in CISA KEV and no public proof-of-concept is known. Do: Upgrade self-managed GitLab CE/EE to 19.2.8, 19.3.5, or 19.4.2 (or any later release on a supported line). Until patched, keep the instance off the public internet, restrict who can reach the web UI and API, and review recent CI/CD configuration changes for unexpected regular expressions.	10.0 group max	<1%	PoC ×3	GitLab CE/EE 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2	largeon the order of 10,000–50,000 self-managed GitLab servers (estimate; only unpatched 19.2/19.3/19.4)	4d ago
CVE-2026-85706	Unauthenticated Path Traversal Arbitrary File Read in GitLab CE/EE CVE-2026-85706 is a path traversal flaw (CWE-35) in GitLab Community Edition and Enterprise Edition in which the repository commits API does not properly confine file paths and does not enforce authentication, allowing an unauthenticated attacker to read arbitrary files from the GitLab server. It is triggered by sending a crafted unauthenticated request to the commits API that supplies traversal sequences moving outside the intended repository path. An attacker gains the ability to read arbitrary files on the host, which can expose configuration files, certificates, and stored credentials or keys; related reporting on the recent GitLab patch wave also notes credential theft and code execution flaws, though this CVE itself is the file-read issue. All self-managed GitLab CE and EE deployments are in scope, and CISA did not publish specific affected version ranges in this data. The flaw was added to CISA's KEV catalog on 2026-09-11 and is being actively probed and exploited in the wild within a day of disclosure, with three public proof-of-concept repositories available; ransomware use is not yet confirmed. Do: Upgrade GitLab CE/EE to the patched release identified in GitLab's security advisory (no specific fixed version number is provided in this data), prioritizing internet-facing instances in line with CISA BOD 26-04; if patching is not immediately possible, restrict exposure and review access logs for unauthenticated requests to the commits API containing path traversal sequences. Because arbitrary file read can expose server-side secrets, inventory and rotate credentials, tokens, and keys stored on or reachable by affected GitLab hosts.	10.0	93%	KEV PoC ×13
CVE-2026-90970	Prompt sandbox escape to RCE in GitLab AI Gateway GitLab AI Gateway contains a prompt-template sandbox escape tracked as CVE-2026-90970 (CWE-1336). An authenticated user who already has Duo Agent Platform access can, under certain conditions, submit a specially crafted flow configuration that breaks out of the prompt template sandbox. The result is arbitrary command execution on the AI Gateway, scored CVSS 3.1 9.9 (network, low complexity, low privileges, changed scope, and high impact on confidentiality, integrity, and availability). Affected builds are AI Gateway 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1. No public proof of concept is known and the issue is not in CISA KEV. Do: Upgrade GitLab AI Gateway to 19.2.4, 19.3.2, or 19.4.1 on the matching release line. Until then, restrict Duo Agent Platform access to trusted users and review flow configurations and AI Gateway hosts for unexpected process or command activity.	9.9	<1%	PoC	GitLab AI Gateway 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1	—	14d ago

CVE

Vulnerability

CVSS

EPSS

Flags

Affected

Exposure

Published

CVE-2026-0723

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 18.6.4, 18.7 before 18.7.2, and 18.8 before 18.8.2 that could have…

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 18.6.4, 18.7 before 18.7.2, and 18.8 before 18.8.2 that could have allowed an individual with existing knowledge of a victim's credential ID to bypass two-factor authentication by submitting forged device responses.

NVD description · AI analysis pending

7.4

<1%

gitlab gitlab

—

Jan 22, 2026

CVE-2026-97229

Unauthenticated RCE in GitLab CE/EE via CI/CD regex

GitLab remediated a critical flaw in GitLab Community Edition and Enterprise Edition in which insufficient validation of a regular expression in CI/CD configuration can let an unauthenticated remote attacker run arbitrary code on the GitLab server under certain conditions. The issue is triggered by a specially crafted regular expression supplied through CI/CD configuration and does not require a logged-in user. Successful exploitation yields full confidentiality, integrity, and availability impact on the server, with a changed scope (CVSS 3.1 10.0). It affects all 19.2 releases before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. It is not listed in CISA KEV and no public proof-of-concept is known.

Do: Upgrade self-managed GitLab CE/EE to 19.2.8, 19.3.5, or 19.4.2 (or any later release on a supported line). Until patched, keep the instance off the public internet, restrict who can reach the web UI and API, and review recent CI/CD configuration changes for unexpected regular expressions.

10.0

group max

<1%

PoC ×3

GitLab CE/EE 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2

largeon the order of 10,000–50,000 self-managed GitLab servers (estimate; only unpatched 19.2/19.3/19.4)

4d ago

CVE-2026-85706

Unauthenticated Path Traversal Arbitrary File Read in GitLab CE/EE

CVE-2026-85706 is a path traversal flaw (CWE-35) in GitLab Community Edition and Enterprise Edition in which the repository commits API does not properly confine file paths and does not enforce authentication, allowing an unauthenticated attacker to read arbitrary files from the GitLab server. It is triggered by sending a crafted unauthenticated request to the commits API that supplies traversal sequences moving outside the intended repository path. An attacker gains the ability to read arbitrary files on the host, which can expose configuration files, certificates, and stored credentials or keys; related reporting on the recent GitLab patch wave also notes credential theft and code execution flaws, though this CVE itself is the file-read issue. All self-managed GitLab CE and EE deployments are in scope, and CISA did not publish specific affected version ranges in this data. The flaw was added to CISA's KEV catalog on 2026-09-11 and is being actively probed and exploited in the wild within a day of disclosure, with three public proof-of-concept repositories available; ransomware use is not yet confirmed.

Do: Upgrade GitLab CE/EE to the patched release identified in GitLab's security advisory (no specific fixed version number is provided in this data), prioritizing internet-facing instances in line with CISA BOD 26-04; if patching is not immediately possible, restrict exposure and review access logs for unauthenticated requests to the commits API containing path traversal sequences. Because arbitrary file read can expose server-side secrets, inventory and rotate credentials, tokens, and keys stored on or reachable by affected GitLab hosts.

10.0

93%

KEV PoC ×13

CVE-2026-90970

Prompt sandbox escape to RCE in GitLab AI Gateway

GitLab AI Gateway contains a prompt-template sandbox escape tracked as CVE-2026-90970 (CWE-1336). An authenticated user who already has Duo Agent Platform access can, under certain conditions, submit a specially crafted flow configuration that breaks out of the prompt template sandbox. The result is arbitrary command execution on the AI Gateway, scored CVSS 3.1 9.9 (network, low complexity, low privileges, changed scope, and high impact on confidentiality, integrity, and availability). Affected builds are AI Gateway 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1. No public proof of concept is known and the issue is not in CISA KEV.

Do: Upgrade GitLab AI Gateway to 19.2.4, 19.3.2, or 19.4.1 on the matching release line. Until then, restrict Duo Agent Platform access to trusted users and review flow configurations and AI Gateway hosts for unexpected process or command activity.

9.9

<1%

PoC

GitLab AI Gateway 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1

—

14d ago