CVE-2026-97229: Critical GitLab RCE Flaw Enables Unauthenticated Code Execution

GitLab has released emergency security updates addressing CVE-2026-97229, a maximum-severity remote code execution vulnerability affecting GitLab Community Edition (CE) and Enterprise Edition (EE). The flaw has a CVSS score of 10.0 and could allow an unauthenticated remote attacker to execute arbitrary code on a vulnerable GitLab server under certain conditions.

The vulnerability resides in GitLab’s CI/CD Regular Expression Compiler and results from insufficient validation of specially crafted regular expressions. Successful exploitation could compromise the confidentiality, integrity, and availability of a GitLab environment without requiring authentication or user interaction.

GitLab released patched versions 19.2.8, 19.3.4, and 19.4.2 on October 12, 2026, strongly urging administrators of self-managed installations to upgrade immediately. GitLab.com already runs the fixed release, while GitLab Dedicated customers do not need to take additional action.

With source-code management and CI/CD infrastructure containing sensitive repositories, credentials, deployment secrets, and access to production environments, vulnerabilities in GitLab can create significant risks for modern software supply chains.

Security teams can strengthen their defenses against emerging vulnerability exploitation with SOC Prime’s AI-Native Detection Intelligence Platform, accelerating threat hunting and detection engineering while adapting detection logic to their organization’s security telemetry.

Contact Sales

CVE-2026-97229 Analysis

CVE-2026-97229 affects GitLab CE and EE installations across three currently vulnerable release branches:

• GitLab 19.2 before 19.2.8
• GitLab 19.3 before 19.3.4
• GitLab 19.4 before 19.4.2

The vulnerability is caused by an integer overflow in the CI/CD Regular Expression Compiler. This component processes regular expressions used within project pipeline configurations. According to GitLab, insufficient regular expression validation can allow an unauthenticated attacker to supply a specially crafted expression that ultimately results in arbitrary code execution on the GitLab server.

GitLab assigned the vulnerability the maximum CVSS 3.1 score of 10.0, with the vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. This reflects the severity of a network-accessible vulnerability that requires neither authentication nor user interaction and can potentially have a high impact on confidentiality, integrity, and availability.

The flaw is particularly dangerous because GitLab servers commonly occupy a highly privileged position within development infrastructure. They can host proprietary source code, CI/CD variables, deployment credentials, access tokens, configuration files, and integrations with cloud and production environments.

Arbitrary code execution on the underlying GitLab server could therefore provide attackers with opportunities to access sensitive repositories, extract secrets, manipulate source code, interfere with pipelines, establish persistence, or use compromised infrastructure as a stepping stone toward additional systems.

The vulnerability was reported to GitLab through its HackerOne bug bounty program by security researcher joaxcar. GitLab has not publicly specified the exact date on which the issue was initially discovered or privately reported. It was publicly disclosed with the October 12, 2026 critical patch release.

The disclosure follows other recent vulnerabilities affecting GitLab’s regular expression processing components. In September 2026, GitLab patched CVE-2026-93577, another integer overflow in the Regular Expression Compiler, as well as CVE-2026-89078, a double-free vulnerability in the Regular Expression Parser. Those earlier flaws required authentication, whereas the newly disclosed vulnerability can be triggered by an unauthenticated attacker under the conditions described by GitLab.

As of October 12, 2026, GitLab and the referenced security reports have not confirmed active exploitation of the vulnerability in real-world attacks. No publicly validated CVE-2026-97229 PoC has been documented in the primary sources reviewed at the time of writing.

For CVE-2026-97229 detection, defenders should monitor self-managed GitLab infrastructure for suspicious CI/CD configuration activity, unusual regular expressions, unexpected GitLab service behavior, and abnormal processes spawned from server-side GitLab components.

Because successful exploitation provides arbitrary code execution, post-exploitation behavior could vary considerably depending on an attacker’s objectives. Monitoring should therefore extend beyond vulnerability-specific request patterns to include process execution, outbound network activity, credential access, persistence mechanisms, and unexpected modification of repositories or CI/CD configuration.

CVE-2026-97229 Mitigation

GitLab strongly recommends that administrators of self-managed CE and EE deployments immediately upgrade to one of the fixed versions:

• 19.4.2 or later
• 19.3.4 or later
• 19.2.8 or later

GitLab.com has already been upgraded to a patched version, and GitLab Dedicated customers do not need to take action. CERT-EU similarly recommends prioritizing upgrades for self-managed instances, particularly those directly accessible from the internet.

Organizations should first inventory self-managed GitLab installations and determine their precise versions. Internet-facing instances and servers integrated with sensitive development, deployment, cloud, or production infrastructure should receive the highest remediation priority.

Administrators should also review recent CI/CD configuration changes for unexpected or unexplained regular expression patterns. Suspicious configuration modifications should be correlated with authentication activity, Git repository changes, server telemetry, and process execution events.

To Detect CVE-2026-97229 exploitation attempts, security teams should look for unusual activity involving GitLab CI/CD configuration processing followed by anomalous server-side process execution, unexpected shell activity, outbound connections, or changes to sensitive repositories and pipeline resources.

Since GitLab has not disclosed attack-specific CVE-2026-97229 IOCs, defenders should rely on behavioral monitoring rather than waiting for static hashes, IP addresses, or domains. Organizations that discover indicators of possible exploitation should treat the GitLab server as potentially compromised and investigate access to CI/CD secrets, repository credentials, runners, deployment tokens, and connected infrastructure.

Credentials and secrets accessible from a suspected compromised instance should be rotated after containment. Security teams should also review repository history and pipeline configurations for unauthorized changes that could establish software supply chain persistence even after the underlying server has been patched.

SOC Prime’s AI-Native Detection Intelligence Platform can help security teams operationalize emerging threat intelligence and adapt detection logic to their SIEM, EDR, and other security environments, supporting faster investigation of suspicious behavior associated with critical vulnerabilities.