GitLab CVE-2026-97229: CVSS 10 CI regex bug runs code, no login

A perfect 10. GitLab CVE-2026-97229 lets an unauthenticated attacker run arbitrary code on a self-managed GitLab server through a crafted regular expression in CI/CD configuration. No account. No user click. GitLab shipped the fix on October 12 and told every self-managed customer to upgrade immediately.

What actually happened

GitLab's critical patch release 19.4.2, 19.3.5 and 19.2.8 lists CVE-2026-97229 as an integer overflow in the CI/CD regular expression compiler. Regex validation was insufficient, so a specially crafted pattern could push the server into executing attacker code. The vector is CVSS 3.1 10.0: network-reachable, low complexity, no privileges, no user interaction, and a scope change. It was reported through HackerOne by the researcher joaxcar.

Affected: Community and Enterprise Editions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. GitLab.com already runs the fix. GitLab Dedicated customers need no action. Self-managed is on you.

The same release fixes 23 other security issues, including five rated High: an XSS in syntax highlighting, two pipeline authorization bugs, a permissive regex in repository file access, and a prompt-injection issue in the Duo Agent Platform. GitLab says full issue details go public 90 days after release.

As of Monday, Cybersecurity Dive reported it was unclear whether attackers had started exploiting the flaw, and CISA had not added it to its Known Exploited Vulnerabilities catalog. GitLab's advisory does not claim exploitation either.

Why it matters for your business

Your GitLab server holds the keys to everything. CI variables carry deploy keys, cloud credentials, registry tokens and payment API secrets. Code execution on the GitLab host is a path to production, not just to source code.

"Not exploited yet" has a short shelf life. The fix is public, and a diff is a map. We saw the same pattern with an earlier GitLab RCE whose proof-of-concept followed the patch. Treat this as a same-day job.

Know your version before you need it. Small teams often run GitLab on a VM that someone set up two years ago. If nobody can name the version in ten seconds, that is the real finding.

Our order of operations: upgrade to the latest patch on your branch (19.4.2, 19.3.5 or 19.2.8). Then rotate CI/CD variables and runner tokens if the instance faced the internet. Then check the logs for unusual pipeline config submissions.

Sources: GitLab Critical Patch Release 19.4.2, 19.3.5, 19.2.8, Cybersecurity Dive.