Urgent awareness alert. This is awareness content, not a monitored threat intelligence service: always check vendor advisories against your own environment.
On 29 October 2026 CISA added a critical GitLab flaw (CVE-2026-97229, CVSS 10.0) to its Known Exploited Vulnerabilities catalogue, based on evidence of active exploitation. It is an integer overflow in the regular expression compiler used by GitLab CI/CD, in both GitLab Community Edition and Enterprise Edition. Under certain conditions, an unauthenticated attacker can use it to run code on the GitLab server. GitLab released fixes on 12 October 2026: versions 19.2 before 19.2.8, 19.3 before 19.3.4, and 19.4 before 19.4.2 are affected. GitLab.com was patched before the flaw was disclosed, so this affects self-managed installations.
What to do:
- Upgrade self-managed GitLab to 19.4.2, 19.3.4, 19.2.8, or later. The fix is in the Ruby that ships with GitLab’s official packages and container images, so if your installation uses a separately installed Ruby (for example, some Linux distribution builds), make sure that Ruby is updated too.
- Check for compromise: review recent CI/CD configuration changes, pipeline runs, and new or changed accounts and access tokens, and look for unexpected processes or outbound connections from the GitLab server. If you find signs of compromise, rotate credentials and secrets stored in GitLab.
- Restrict exposure: limit who can reach your GitLab instance from the internet while you patch.
Source: GitLab critical patch release 19.4.2, 19.3.4, 19.2.8 and CISA alert, 29 October 2026
If you would like help assessing your exposure, contact us.
