On 29 October 2026 the US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-97229, a critical GitLab flaw, to its Known Exploited Vulnerabilities catalog. The bug, rated CVSS 10.0, can let an unauthenticated attacker run code on a self-managed GitLab server. GitLab released fixed versions on 12 October 2026.
What happened
- 12 October 2026, the fix. GitLab published patch releases 19.4.2, 19.3.5 and 19.2.8 for Community Edition and Enterprise Edition. Its advisory describes CVE-2026-97229 as an integer overflow in the CI/CD regular expression compiler: under certain conditions, a specially crafted regular expression in a CI/CD configuration could let an unauthenticated user execute arbitrary code on the server. GitLab rated it Critical with a CVSS score of 10.0 and listed 19.2 before 19.2.8, 19.3 before 19.3.5 and 19.4 before 19.4.2 as affected.
- Who must act. According to GitLab, GitLab.com was already running the patched version and GitLab Dedicated tenants were patched before the release was published. Self-managed installations have to upgrade themselves.
- 20 to 21 October 2026, an attack in the wild. As reported by The Hacker News, the Alpine Linux project disclosed an attempt against its own unpatched GitLab instance. The attacker submitted crafted CI configurations that crashed GitLab worker processes eight times and also downloaded Alpine's GitLab container image. Later attempts on 25 and 26 October were blocked. Alpine found no evidence that the attack succeeded but rebuilt the instance from scratch.
- 29 October 2026, the CISA listing. CISA added the GitLab flaw to its catalog alongside a Cisco Secure Firewall ASA and FTD denial-of-service flaw (CVE-2026-76418). The Hacker News reported on 30 October that US federal civilian agencies are expected to apply the fixes by 1 November 2026.
What it means for businesses
The CISA deadline applies to US federal civilian agencies, not private companies. A KEV listing is still a useful signal for everyone else: it means a government agency has evidence the flaw is being used in real attacks, so it is no longer a theoretical risk.
For many organisations, a source code platform holds more than code. GitLab instances often store CI/CD variables, deployment keys, access tokens and container registry credentials. Code execution on that server can therefore reach the systems those pipelines deploy to, such as production apps, cloud accounts and customer databases.
Three points stand out:
- The fix existed for more than two weeks before the listing. Teams that patch on a monthly cycle, or only after an incident makes the news, were exposed during that gap.
- Custom builds need extra checking. GitLab's release notes for these versions also list patches to Ruby's regular expression handling. Teams that run GitLab from their own images or builds, rather than the official packages, should confirm their runtime actually carries the fix, not just the new GitLab version number.
- A failed attack can still be costly. Alpine rebuilt its instance because it could not fully rule out success. Good logs make that decision easier and cheaper.
What to do next
- Find every GitLab instance you run, including test servers, old build machines and anything a supplier hosts for you, and note its version.
- Upgrade self-managed instances to 19.4.2, 19.3.5 or 19.2.8 or later. GitLab notes that single-node instances need downtime because database migrations must finish before GitLab starts, so plan a short maintenance window. Versions older than 19.2 are not listed as affected by this flaw, but the same release fixes other issues in older versions, so plan an upgrade path to a supported release.
- Check custom images. If you build your own GitLab image, verify the bundled Ruby includes the regular expression fixes from the official release.
- Reduce exposure while you patch. Limit public access to the instance, close open sign-ups, and review who can create projects or edit CI/CD configuration files.
- Look for warning signs. Unexplained worker crashes, unexpected pipeline runs and new accounts submitting CI changes all deserve a closer look.
- Rotate secrets if in doubt. If an instance was unpatched and reachable from the internet during October, consider rotating CI/CD variables, deploy keys and tokens.
- Make patching routine. Agree a target time for applying critical fixes and keep outbound and access logs long enough to investigate an incident afterwards.
For background on keeping systems current, see our guide on what software maintenance covers and our security and data protection page.
Timeline Digital, a custom software development company founded in 2013 in Islamabad, builds and runs custom software as managed projects, including DevOps and cloud infrastructure work such as CI/CD pipelines, monitoring and patching for the systems we deliver. Every project starts with a free pilot: Before you commit to the full project, we build 2 to 3 of your key modules as working software, free of charge, ready in about 2 days. Your team tests the pilot, and the full build starts only after you approve it.
Sources
- GitLab Patch Release: 19.4.2, 19.3.5, 19.2.8, GitLab, 12 October 2026
- CISA Adds Two Known Exploited Vulnerabilities to Catalog, CISA, 29 October 2026
- CISA Adds Actively Exploited GitLab RCE and Cisco Firewall DoS Flaws to KEV, The Hacker News, 30 October 2026