A critical security vulnerability in GitLab is now being actively exploited, prompting cybersecurity authorities to urge organizations to update affected systems immediately. The vulnerability, tracked as CVE-2026-97229, affects GitLab Community Edition (CE) and Enterprise Edition (EE) and could allow attackers to execute arbitrary code on vulnerable servers under certain conditions.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog on October 29, 2026, confirming that exploitation has been observed in the wild. The flaw carries a maximum CVSS 3.1 severity score of 10.0, placing it in the critical category and making it a high-priority concern for organizations operating exposed GitLab infrastructure.
What Is the GitLab Vulnerability?
CVE-2026-97229 is an integer overflow vulnerability in GitLab's CI/CD regular expression compiler. The issue occurs when specially crafted regular expressions are processed under certain conditions, potentially allowing an attacker to trigger unexpected behavior in the compiler and execute code on the affected GitLab server.
The vulnerability is connected to insufficient validation of regular expressions used in CI/CD configuration files. GitLab's security advisory explains that a specially crafted expression could allow an unauthenticated user to execute arbitrary code on a vulnerable server. The potential consequences include unauthorized access to server resources, disruption of development services and compromise of sensitive information.
CISA Confirms Active Exploitation
The addition of CVE-2026-97229 to CISA's KEV Catalog is an important development because the catalog tracks vulnerabilities known to have been exploited in real-world attacks. The U.S. agency's action followed reports of exploitation attempts against vulnerable GitLab infrastructure.
The Canadian Centre for Cyber Security also updated its advisory on October 29 to highlight the CISA listing. Separately, cybersecurity researchers at Rapid7 reported reproducing arbitrary code execution against an unpatched GitLab Community Edition installation and recommended urgent upgrades for affected self-managed deployments.
Rapid7's technical analysis adds an important qualification: its demonstrated exploitation path required a way to introduce a malicious CI/CD configuration into a repository before triggering the vulnerable code. This means the practical attack conditions depend on the target's project and access configuration, even though the vendor's vulnerability assessment assigns a maximum-severity score.
Which GitLab Versions Are Affected?
The vulnerability affects specific release branches of GitLab Community Edition and Enterprise Edition. Organizations should check their installed version and compare it with the fixed releases published by GitLab.
- GitLab 19.2 versions earlier than 19.2.8 are affected.
- GitLab 19.3 versions earlier than 19.3.5 are affected.
- GitLab 19.4 versions earlier than 19.4.2 are affected.
GitLab released security updates on October 12, 2026, fixing the vulnerability in versions 19.2.8, 19.3.5 and 19.4.2. The company strongly recommends that administrators of affected self-managed installations upgrade to the appropriate fixed release or a newer supported version.
What Organizations Should Do Immediately
Security teams should identify all self-managed GitLab Community Edition and Enterprise Edition installations and determine whether they are running an affected release. Internet-facing instances should receive particular attention because they may be reachable by untrusted users.
Administrators should install the relevant GitLab security update as soon as possible, following the vendor's upgrade instructions. Organizations should also review GitLab security detection guidance, inspect logs for suspicious activity and investigate potential compromise rather than assuming that installing a patch automatically removes evidence of an earlier intrusion.
Where immediate patching is not possible, organizations should consider restricting access to affected instances and limiting untrusted users' ability to create or modify public projects. These temporary controls may reduce exposure to demonstrated attack paths, but they do not replace installing the security update.
Are GitLab.com Users Also at Risk?
GitLab has stated that its GitLab.com infrastructure is already running a patched version. GitLab Dedicated customers were also patched through an internal release before the public patch announcement, so those customers do not need to perform the same manual upgrade for this issue.
The primary concern is therefore organizations operating affected self-managed GitLab installations. Companies that host their own source-code repositories and CI/CD pipelines should verify their software versions and review their security monitoring procedures.
Why This Vulnerability Matters
GitLab is widely used to manage source code, automate software builds and coordinate deployment pipelines. A compromise of a self-managed GitLab server can therefore create risks beyond the repository itself, potentially affecting development workflows, credentials and connected infrastructure.
The confirmation of active exploitation makes this vulnerability particularly urgent. Organizations should not wait for their next routine maintenance window if they are running an affected release. Applying the vendor's security update, reviewing exposure and investigating suspicious activity are essential steps to reduce the risk of compromise.
