GitLab Admins Urged to Patch Critical RCE Vulnerability (CVE-2026-97229)

Post Views: 9

GitLab administrators are urged to address a critical remote code execution vulnerability (CVE-2026-97229) impacting self-hosted instances of the platform.

Vulnerability Details

GitLab administrators are being advised to address a critical remote code execution vulnerability (CVE-2026-97229) impacting self-hosted instances of the platform. The flaw resides in the CI/CD Regular Expression Compiler and could enable unauthenticated attackers to execute arbitrary code on affected servers through maliciously crafted regular expressions in CI/CD configurations. The vulnerability was identified and resolved in recent software updates, with the affected versions spanning multiple release lines. The flaw, classified as an integer overflow vulnerability, affects both Community Edition (CE) and Enterprise Edition (EE) of GitLab. It has been assigned a CVSS score of 10.0, indicating the highest severity rating. Exploitation requires minimal complexity and no user interaction, as the vulnerability can be triggered remotely without prior authentication. The advisory highlights that insufficient validation of regular expressions in CI/CD pipelines created a pathway for attackers to compromise systems.

Patched Versions and Affected Releases

Patches for the issue were included in GitLab CE and EE versions 19.4.2, 19.3.5, and 19.2.8, released on October 12, 2026. These updates address the vulnerability in all prior versions within the affected release ranges. Specifically, versions 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 are vulnerable. The company emphasized that users must upgrade to one of the patched versions immediately to mitigate risks. GitLab.com and GitLab Dedicated customers are already protected, as they are running the updated software. However, self-managed installations require manual intervention to apply the fixes.

Importance of Immediate Upgrade

The vulnerability was disclosed by a researcher known as joaxcar via the HackerOne bug bounty program. This same individual also reported CVE-2026-7767, a medium-severity open redirect flaw in the Kubernetes proxy component that could expose authentication tokens to unauthorized servers. This latest patch follows a series of security updates from GitLab in 2026. In August, the company addressed CVE-2026-19478, a critical code injection vulnerability that allowed unauthorized modifications to public projects and user data. The ongoing efforts reflect the platform’s commitment to resolving high-impact flaws promptly. Organizations using GitLab must prioritize applying the latest patches to prevent potential exploitation. The vulnerability’s ease of exploitation and lack of required user interaction underscore the urgency of the update. Technical teams are encouraged to review their deployment configurations and ensure compliance with the recommended version upgrades.

“This same individual also reported CVE-2026-7767, a medium-severity open redirect flaw in the Kubernetes proxy component that could expose authentication tokens to unauthorized servers.”

Conclusion

GitLab administrators must act swiftly to apply the necessary patches and secure their self-hosted instances against this critical vulnerability. The high CVSS score and ease of exploitation leave no room for delay in addressing this issue.