Critical GitLab CVE-2026-97229 Flaw Exploited in the Wild

The US Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that attackers are actively exploiting a maximum-severity security vulnerability in GitLab. Tracked as CVE-2026-97229, the critical flaw demands immediate attention from server administrators.

Qisqacha: - CVE-2026-97229 is a max-severity flaw in GitLab's CI/CD component. - Unauthenticated attackers can achieve remote code execution. - CISA added the vulnerability to its KEV catalog following active exploitation.

Background and Technical Details of the Flaw Discovered by a security researcher known as 'joaxcar', the vulnerability resides within the CI/CD Regular Expression Compiler, which parses and evaluates regular expressions in pipeline configuration files. The bug stems from an integer overflow weakness combined with insufficient expression validation. Under specific conditions, malicious actors can leverage a specially crafted regular expression inside a CI/CD configuration file. This allows unauthenticated remote attackers to execute arbitrary code on targeted GitLab instances, posing severe risks to server integrity.

GitLab Response and CISA Directives In response to the active exploitation attempts, GitLab addressed the flaw in Community Edition (CE) and Enterprise Edition (EE) versions 19.4.2, 19.3.5, and 19.2.8. The company strongly urged administrators to apply patches immediately and released threat detections for self-managed instances. CISA subsequently added CVE-2026-97229 to its Known Exploited Vulnerabilities catalog and ordered federal agencies to secure their systems under Binding Operational Directive 26-04. Threat monitors have tracked thousands of internet-exposed instances globally.

Impact on Enterprise Security GitLab's platform serves over 70 million registered users and more than half of Fortune 100 enterprises. This incident follows a series of high-profile security patches issued by GitLab since the beginning of the year, highlighting ongoing challenges in securing complex DevSecOps tools. Security teams across both public and private sectors are advised to prioritize applying these patches to safeguard their networks against continuing exploitation attempts and potential data breaches.