GitLab CI/CD regex flaw allows unauthenticated RCE (CVE-2026-97229)

GitLab has patched CVE-2026-97229, a CVSS 10.0 flaw in the CI/CD Regular Expression Compiler of GitLab Community Edition (CE) and Enterprise Edition (EE) that could let an unauthenticated attacker run arbitrary code on the server, according to Help Net Security. Fixes shipped on October 12, 2026 in versions 19.4.2, 19.3.5 and 19.2.8. Exploitation in the wild has not been reported in the material we reviewed, and there is no CISA KEV entry for this CVE in our data.

What happened

GitLab says it remediated an issue that, under certain conditions, could allow an unauthenticated user to execute code on the GitLab server through a specially crafted regular expression in a CI/CD configuration. The root cause is insufficient validation of that regular expression. Help Net Security describes it as an integer overflow, and NVD maps it to CWE-190 (integer overflow or wraparound).

The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. In plain terms: reachable over the network, low complexity, no privileges and no user interaction, with a changed scope and high impact on confidentiality, integrity and availability.

The flaw was reported by a researcher using the handle joaxcar through GitLab’s HackerOne bug bounty program. The same researcher also reported CVE-2026-7767, a medium-severity open redirect in GitLab’s Kubernetes proxy that could cause sensitive authentication tokens to be sent to an unintended server.

Am I affected by CVE-2026-97229?

Only self-managed GitLab installations need action. GitLab states that GitLab.com already runs the patched version and that GitLab Dedicated customers do not need to act.

• GitLab 19.2 before 19.2.8: vulnerable, fixed in 19.2.8
• GitLab 19.3 before 19.3.5: vulnerable, fixed in 19.3.5
• GitLab 19.4 before 19.4.2: vulnerable, fixed in 19.4.2

Both CE and EE are affected. Whether versions older than 19.2 are affected is not disclosed in the sources we reviewed; check the GitLab advisory and treat unsupported releases as a reason to upgrade anyway. GitLab notes that 19.3.4 had a bug affecting merge request pages when the Ona integration was enabled, which 19.3.5 fixes.

Why this matters

Analysis, not reported fact. A self-managed GitLab server usually holds source code, CI/CD variables, deploy keys and runner registrations. Code execution on that host can therefore become a supply-chain problem, not just a server compromise. The unauthenticated, low-complexity vector means any instance reachable by untrusted networks, including the internet, should be treated as the highest priority. Instances only reachable on an internal network are lower risk but still exposed to any internal user or compromised workstation.

The EPSS score for this CVE is not disclosed in the data we have, and it is not in CISA KEV at the time of writing. That should not reduce urgency: a CVSS 10.0 unauthenticated RCE in a widely deployed DevOps platform tends to attract quick exploit development once details circulate. If your instance is internet-facing, patch within hours, not at the next maintenance window.

Technical details

• CVE: CVE-2026-97229 (published in NVD on October 13, 2026)
• Component: CI/CD Regular Expression Compiler
• Weakness: CWE-190, integer overflow or wraparound
• Attack vector: a crafted regular expression in a CI/CD configuration
• Exploitation status: no in-the-wild exploitation reported in the sources reviewed
• Indicators of compromise: none published

The trigger is a CI/CD configuration, so it is worth understanding who can supply one to your instance. The sources do not say exactly which endpoints or project settings are reachable without authentication, so do not assume that restricting sign-ups alone is a mitigation.

How to detect possible exploitation

No indicators have been published, so detection has to follow from the facts. These are suggestions, not confirmed signatures:

• Review web and application logs from before you patched for unusual requests that submit or lint CI/CD configuration content, especially from unauthenticated or unfamiliar sources.
• Look for unexpected child processes spawned by the GitLab application user (for example shells or download tools) and for new outbound connections from the GitLab host.
• Check for new or modified runners, deploy keys, personal access tokens, webhooks and CI/CD variables you did not create.
• If the instance was exposed and unpatched for any period, consider rotating secrets stored in CI/CD variables.

What to do

1. Identify every self-managed GitLab CE and EE instance, including test and forgotten ones, and record its version.
2. Upgrade to 19.4.2, 19.3.5 or 19.2.8, whichever matches your release line. GitLab says it strongly recommends upgrading immediately.
3. Prioritise internet-facing instances first, then internal ones.
4. After patching, run the log and persistence checks above, and rotate CI/CD secrets if you suspect exposure.
5. Tell platform and engineering owners, since pipelines may be briefly disrupted during the upgrade.

GitLab has fixed several serious flaws recently. In August it patched CVE-2026-19478, a critical code injection issue that could be exploited without authentication to modify or delete public projects and user data, so a regular patch cadence for self-managed instances is worth building into your process.

Related coverage

• Bricksforge WordPress plugin flaw exploited for RCE (CVE-2026-85097)
• Hitachi Energy SOI exposed to ActiveMQ RCE flaw (CVE-2026-34197)
• Zammad session fixation flaw CVE-2026-102489 exploited, CISA KEV

Sources

• NVD: CVE-2026-97229
• GitLab patch release 19.4.2, 19.3.5 and 19.2.8
• Help Net Security: GitLab admins urged to patch critical RCE flaw