GitLab Patches CVSS 10.0 Flaw That Could Let Unauthenticated Attackers Run Code on Servers

GitLab says self-managed servers should be patched outside the normal cycle — a crafted pipeline file could hand an attacker the server itself

October 13, 2026 — GitLab has urged administrators of self-managed installations to upgrade immediately after disclosing CVE-2026-97229, a maximum-severity flaw rated CVSS 10.0. The bug, an integer overflow in the CI/CD Regular Expression Compiler, could allow an unauthenticated attacker to execute arbitrary code on a vulnerable GitLab server through a specially crafted regular expression in a CI/CD configuration, according to the company.

Image: A server room under a red security alert as engineers rush to patch a code pipeline. Credit: AI-generated illustration / Red Eye Eagle News, original illustration.

Editor's Highlight: This is not a routine patch Tuesday item. A flaw that needs no login, sits in software that holds source code and pipeline secrets, and scores the highest possible severity should move to the front of every engineering team's queue today.

Table of Contents

• Key Facts
• What the Flaw Is and How It Works
• Which Versions Are Affected and Fixed
• Why a GitLab Server Is a High-Value Target
• What Rapid7 Added — and What Is Not Yet Known
• What Administrators Should Do Now
• Bottom Line
• FAQ
• Sources

Key Facts

Detail	Information
Flaw	CVE-2026-97229, integer overflow in the CI/CD Regular Expression Compiler
Severity	CVSS 10.0, the highest possible score
Products affected	GitLab Community Edition (CE) and Enterprise Edition (EE), self-managed
Affected versions	19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2
Fixed versions	19.4.2, 19.3.5 and 19.2.8, released October 12, 2026
Attack requirements	Remote, low complexity, no privileges and no user interaction, per the CVSS rating
Reported by	Researcher using the handle joaxcar, via GitLab's HackerOne programme
Cloud status	GitLab.com already patched; GitLab Dedicated customers need no action, the company says

What the Flaw Is and How It Works

The vulnerable component compiles regular expressions found in CI/CD configuration files — the instructions that tell GitLab how to build, test and deploy software.

According to GitLab, insufficient validation meant a specially crafted expression could reach the compiler and, under certain conditions, lead to code execution on the server itself.

Security reporting describes the root cause as an integer overflow (CWE-190): a size calculation goes wrong, memory is under-allocated, and writing can spill beyond the intended boundary.

Tech Analysis: The danger is the trust model. Pipeline configuration is input GitLab is designed to accept and process automatically, so a parsing flaw there is far more exposed than a bug hidden behind an admin-only screen.

Which Versions Are Affected and Fixed

The flaw affects both GitLab CE and GitLab EE. GitLab released the fixes on October 12, 2026, and said the patched builds contain important bug and security fixes.

Branch	Affected	Upgrade to
19.4	Before 19.4.2	19.4.2
19.3	Before 19.3.5	19.3.5
19.2	Before 19.2.8	19.2.8

The same release also addresses other high-severity issues, according to The Hacker News. They include CVE-2026-92883 (CVSS 8.7), a cross-site scripting flaw, and CVE-2026-16301 (CVSS 8.5), an authorization flaw involving pipelines on protected branches.

A third high-severity bug, CVE-2026-14814 (CVSS 8.2), involves cached responses for raw repository files and could expose protected environment variables in some cases.

Why a GitLab Server Is a High-Value Target

A compromised GitLab instance is rarely just one compromised application. It typically holds an organisation's source code, its build history and its deployment path to production.

It may also hold CI/CD variables, runner tokens and deploy keys. An attacker running code there could potentially read secrets or tamper with builds that later ship to customers.

Practical Takeaway: After patching, teams should also review pipeline variables, tokens and recent project changes — upgrading the software closes the hole, but it does not by itself prove nothing was touched beforehand.

What Rapid7 Added — and What Is Not Yet Known

In an update on October 13, Help Net Security reported that Rapid7 researchers reproduced arbitrary code execution on an unpatched official GitLab CE 19.4.1 image, while the same input did not work against the patched 19.4.2 image.

Rapid7 added an important nuance, according to that report: an attacker would first need to be able to commit a malicious .gitlab-ci.yml file and use a repository path containing UTF-8 characters in a public project — something an ordinary account can do on instances that allow public projects.

Rapid7 said there was no confirmed in-the-wild exploitation at that point. That distinction matters. A lab reproduction shows the flaw is real and usable; it is not evidence attackers are already using it at scale.

What Administrators Should Do Now

• Upgrade first: Move self-managed CE and EE instances to 19.4.2, 19.3.5 or 19.2.8 for their branch, prioritising internet-facing servers.
• Check the version: Confirm the running build after the upgrade, not just that an update was scheduled.
• Review logs: Look for unusual unauthenticated requests and unexpected pipeline or project changes around the disclosure window.
• Audit secrets: Review CI/CD variables, runner tokens and deploy keys, and rotate them if exposure is plausible.
• Reduce exposure: Where possible, limit who can reach the instance from the public internet while the patch is rolled out.

GitLab.com users need no action, because the company says that service already runs the patched version, and GitLab Dedicated customers likewise need none. Self-managed teams should treat this as an emergency change, not a routine update.

Bottom Line

CVE-2026-97229 combines the three traits defenders dislike most: maximum severity, no authentication in the vendor rating, and a target that holds code and secrets. The fixes have been available since October 12. What to watch next is whether exploitation reports emerge and how quickly exposed self-managed instances disappear from the internet.

FAQ

What is CVE-2026-97229?

It is an integer overflow vulnerability in GitLab's CI/CD Regular Expression Compiler. According to GitLab, a specially crafted regular expression in a CI/CD configuration could allow an unauthenticated user to execute arbitrary code on the server.

Which GitLab versions are affected?

Self-managed GitLab CE and EE versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 are affected, according to the advisory reporting.

What should self-managed administrators do?

Upgrade immediately to 19.4.2, 19.3.5 or 19.2.8, depending on the branch in use. GitLab strongly recommends the upgrade for all self-managed installations, and Rapid7 recommends doing it outside the normal patch cycle.

Do GitLab.com users need to do anything?

No. GitLab says GitLab.com is already running the patched version, and GitLab Dedicated customers do not need to take action.

Has the flaw been exploited in the wild?

Not confirmed, as of October 13 reporting. Rapid7 said there was no confirmed in-the-wild exploitation at that point, although its researchers did reproduce code execution on an unpatched test image.

Sources

• Help Net Security — GitLab admins urged to patch critical RCE flaw (CVE-2026-97229), October 13, 2026: https://www.helpnetsecurity.com/2026/10/13/gitlab-ci-cd-regular-expression-compiler-vulnerability-cve-2026-97229/
• The Hacker News — GitLab Patches CVSS 10.0 Flaw That Could Let Unauthenticated Users Run Server Code, October 13, 2026: http://thehackernews.com/2026/10/gitlab-patches-cvss-100-flaw-that-could.html
• DEV Community — CVE-2026-97229: GitLab CI/CD Regex Compiler Integer Overflow Vulnerability — Analysis and Mitigation: http://dev.to/iamfaizanakhtar/cve-2026-97229-gitlab-cicd-regex-compiler-integer-overflow-vulnerability-analysis-mitigation-4fpc
• SANS Stormcast (YouTube) — October 13, 2026 episode covering the GitLab CI/CD RCE: https://www.youtube.com/watch?v=lJTX-JJkO9U
• Image: Original AI-generated illustration created for Red Eye Eagle News for this article.