CVE-2026-97229: Critical GitLab RCE vulnerability actively exploited

More than 1,000 internet-exposed GitLab servers are still missing security patches against a maximum-severity remote code execution (RCE) vulnerability. Tracked as CVE-2026-97229, this severe flaw poses an active threat to self-managed enterprise instances worldwide.

• The CVE-2026-97229 vulnerability stems from an integer overflow weakness in the CI/CD Regular Expression Compiler;
• GitLab released security patches on October 12 for Community and Enterprise editions versions 19.4.2, 19.3.5, and 19.2.8;
• CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog, ordering urgent mitigation;
• Threat intelligence firm Shadowserver tracks over 1,000 vulnerable and exposed instances globally.

Vulnerability Details and Root Cause

The flaw resides within the CI/CD Regular Expression Compiler, which parses and evaluates regular expressions inside pipeline configuration files. Due to insufficient regular expression validation, an unauthenticated threat actor can exploit this weakness by submitting a specially crafted regular expression to execute arbitrary code directly on the target GitLab server.

GitLab addressed this issue on October 12 by issuing security updates for GitLab Community Edition (CE) and Enterprise Edition (EE) versions 19.4.2, 19.3.5, and 19.2.8. While GitLab.com runs the patched version and GitLab Dedicated customers require no action, administrators running self-managed server installations were strongly advised to upgrade immediately.

Government Warnings and Active Exploitation

The US Cybersecurity and Infrastructure Security Agency (CISA) confirmed that threat actors have started exploiting the flaw in real-world attacks. CISA formally added CVE-2026-97229 to its Known Exploited Vulnerabilities (KEV) Catalog and instructed federal civilian agencies to secure their affected servers promptly.

Despite patches being available for weeks, threat intelligence watchdogs from Shadowserver revealed that over 1,000 unpatched GitLab instances remain exposed to ongoing attacks. This follows another recent maximum-severity regular expression compiler bug (CVE-2026-110264) which affected over 11,300 instances.

Broader Context of GitLab Security

CVE-2026-97229 is only the latest in a series of prominent GitLab security flaws addressed throughout the year. Earlier vulnerabilities included a high-severity authentication bypass flaw (CVE-2026-0723) and a repository commits API bug (CVE-2026-85706) used for credential theft.

Since November 2021, CISA has added six distinct GitLab flaws to its catalog of actively exploited vulnerabilities, with one instance even leveraged in ransomware attacks. With over 70 million registered users and adoption by more than 50% of Fortune 100 companies, securing the DevSecOps platform remains critical.