GitLab RCE Flaw CVE-2026-97229 Now Under Active Attack, CISA Warns

GitLab's maximum-severity CI/CD vulnerability, CVE-2026-97229, is no longer just a theoretical worst-case bug. The Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on October 29, 2026, confirming that attackers are actively using it against real GitLab Community Edition (CE) and Enterprise Edition (EE) servers. The federal civilian remediation deadline CISA set for the flaw, November 1, 2026, has already passed. Anyone running a self-managed GitLab instance that is still unpatched should treat this as an active incident, not a routine update.

Pandromeda covered GitLab's original disclosure and patch for CVE-2026-97229 on October 22, 2026, ten days after GitLab shipped fixes. What's new here is the confirmation: this is no longer a "patch now, just in case" advisory, it is a vulnerability CISA says is being exploited in the wild right now, with federal agencies already past their legally mandated deadline to fix it.

What's actually new: CISA confirms active exploitation

CISA's Known Exploited Vulnerabilities catalog is reserved for flaws the agency has verified are being used in real attacks, not merely flaws that are theoretically exploitable. According to CISA's own catalog entry, CVE-2026-97229 was added on October 29, 2026, under the listing "GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability," with a required action to "apply mitigations in accordance with vendor instructions" and a due date of November 1, 2026.

That three-day remediation window is short by design. Under CISA's Binding Operational Directive 26-04, issued June 10, 2026, KEV status is one of the explicit triggers that moves a vulnerability into the agency's highest-urgency remediation tier for federal civilian executive branch (FCEB) networks, ahead of vulnerabilities that are merely high-severity but not confirmed as exploited. BOD 26-04 requires agencies to monitor KEV catalog updates continuously and remediate within the timelines CISA assigns — and for CVE-2026-97229, that timeline has now expired.

BOD 26-04 is legally binding only on federal agencies, but CISA's KEV catalog functions as a de facto industry signal: when a CVSS 10.0, unauthenticated RCE bug in widely deployed DevOps infrastructure gets a KEV listing, it means confirmed, real-world attacker activity, not a researcher's proof of concept.

What CVE-2026-97229 actually is

Per GitLab's own October 12, 2026 critical patch release notes, the flaw is an integer overflow in the regular expression compiler GitLab uses to validate CI/CD pipeline configuration. A specially crafted regular expression submitted in a CI/CD configuration — something an unauthenticated user can trigger — overflows an internal counter and allows arbitrary code execution directly on the GitLab server. GitLab credits the discovery to a HackerOne researcher using the handle joaxcar.

The National Vulnerability Database entry for CVE-2026-97229 confirms the base score of 10.0 under CVSS 3.1, with the vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H — network-exploitable, low attack complexity, no privileges or user interaction required, a changed scope, and high impact on confidentiality, integrity, and availability. NVD classifies the underlying weakness as CWE-190 (integer overflow or wraparound). Every scoring factor that can make a vulnerability maximally dangerous is present here, which is why GitLab, NVD, and now CISA all treat it as critical.

GitLab's October 12 release bundled fixes for 23 other vulnerabilities alongside CVE-2026-97229, including five rated High — among them a cross-site scripting flaw in syntax highlighting and an improper-authorization issue in downstream pipeline creation. None of those is the subject of the new CISA KEV listing; CVE-2026-97229 is the one confirmed under active attack.

Timeline: from disclosure to confirmed exploitation

The gap between GitLab's original patch and CISA's active-exploitation confirmation is worth laying out, because it shows how quickly a maximum-severity, unauthenticated flaw can move from "theoretical worst case" to "confirmed attacker tool" once it's public:

Seventeen days elapsed between GitLab's patch and CISA's confirmation that attackers were already using the flaw — a narrow window for defenders who didn't patch immediately after the October 12 disclosure, and a reminder that a maximum-CVSS, unauthenticated RCE in internet-facing infrastructure is exactly the kind of bug that attracts fast attacker attention once technical details are public.

Affected and fixed versions

GitLab's advisory and the NVD record agree on the affected ranges. Self-managed CE and EE installations on any of the following branches, below the listed fixed version, are vulnerable:

One wrinkle worth flagging for anyone working from the original October 12 announcement: GitLab's patch release was titled around 19.3.4 for the 19.3 branch at launch, but GitLab's current advisory and NVD both now list 19.3.5 as the fixed version for that branch — 19.3.4 introduced a separate regression affecting merge request pages when the Ona integration is enabled, so GitLab superseded it. If you are still running anything earlier than 19.3.5 on the 19.3 branch, you are not fully patched for CVE-2026-97229's follow-on fix. GitLab.com (the SaaS product) and GitLab Dedicated customers do not need to take action; the vendor applied the fix to its own hosted infrastructure before the public disclosure.

Who needs to act right now

The exposure is specific: self-managed GitLab CE or EE instances — the kind organizations run on their own servers or cloud infrastructure rather than on gitlab.com — that have not yet been upgraded to 19.4.2, 19.3.5, or 19.2.8. That includes:

• Federal civilian agencies, whose BOD 26-04 remediation window closed on November 1, 2026. Any FCEB system still unpatched is now out of compliance and, per CISA's required action, should either apply the fix or, if mitigation isn't possible, be evaluated for discontinued use under BOD 26-04.
• Any organization running self-managed GitLab for source control or CI/CD, regardless of sector — the vulnerability doesn't require authentication, so internet-facing instances are exploitable by anyone who can reach them.
• Managed service providers and software vendors who host GitLab on behalf of customers and haven't confirmed the upgrade across every managed instance.

Internet-facing, self-managed GitLab servers are the highest-priority case: CISA's required action specifically calls out assessing "each asset's internet exposure" as part of the remediation.

How to check if you're exposed

Confirming exposure starts with the version string. From the GitLab admin area, check Help > version, or run cat /opt/gitlab/version-manifest.txt on an Omnibus install, or check the footer of any GitLab page where version numbers are typically displayed to administrators. Compare the result against the table above. Anything below 19.2.8, 19.3.5, or 19.4.2 on the respective branch is vulnerable and should be treated as a priority patch, not a scheduled maintenance item.

Because CISA has confirmed active exploitation, organizations that are only now getting around to patching should also review GitLab access and audit logs for signs of prior compromise — unexpected CI/CD pipeline runs, unfamiliar runner registrations, newly created admin accounts, or anomalous outbound connections from the GitLab host — rather than assuming a late patch fully closes the incident. Given that CI/CD systems frequently hold credentials for downstream services, it's also worth rotating pipeline secrets and deployment tokens stored on an instance that was exposed to the internet while unpatched, rather than assuming an upgrade alone invalidates anything an attacker may already have collected.

How to patch

GitLab's remediation guidance is the fix itself: upgrade to 19.4.2, 19.3.5, or 19.2.8 (or any later release on the applicable branch) using your normal GitLab upgrade path — Omnibus package manager, Helm chart, Docker image, or source install, depending on how your instance is deployed. GitLab's documentation includes an upgrade path guide for organizations jumping multiple versions, since some major/minor stops are required along the way. There is no supported workaround that leaves CI/CD regex validation in place on an unpatched version; the only fix is the version upgrade.

Organizations unable to patch immediately should, at minimum, restrict network access to the GitLab instance so it isn't reachable from the open internet, and treat the CI/CD configuration intake path as a priority for monitoring until the upgrade is complete.

GitLab's repeat appearances in the KEV catalog

CVE-2026-97229 is not GitLab's first entry in CISA's Known Exploited Vulnerabilities catalog, and the cadence has picked up this year. A review of CISA's own KEV data shows six GitLab CE/EE vulnerabilities have been added to the catalog to date: an RCE flaw in November 2021, an improper access control bug added in May 2024, two older server-side request forgery issues both added in February 2026, a path traversal vulnerability added on September 11, 2026 — roughly seven weeks before this one — and now CVE-2026-97229 on October 29, 2026. Three of GitLab's six KEV listings have landed within the past nine months, which is a reasonable signal that self-managed GitLab instances have become a recurring, active target rather than an occasional one.

That pattern is part of why CISA's required action language for CVE-2026-97229 references BOD 26-04's broader framework rather than treating this as an isolated advisory: repeat KEV entries against the same product push organizations toward continuous monitoring of GitLab's security releases, not just one-time patching after a disclosure.

Why a GitLab RCE matters beyond GitLab itself

GitLab instances typically hold source code, CI/CD secrets, deployment credentials, and pipeline access to production infrastructure. An unauthenticated remote code execution bug in that kind of system isn't just a data-exposure risk — a successful exploit can hand an attacker a foothold inside an organization's software supply chain, with the ability to tamper with pipelines, exfiltrate secrets, or push malicious commits. That's precisely the kind of impact CVSS's "Scope: Changed" rating and high confidentiality/integrity/availability scores are meant to flag, and it's why CISA's KEV listing treats this as urgent rather than routine.

What to watch next

Expect CISA to continue tracking CVE-2026-97229's remediation status under BOD 26-04 reporting requirements for federal agencies, and watch for any updated guidance from GitLab if further exploitation details or indicators of compromise are published. For everyone else, the practical task is unchanged and now more urgent: confirm your GitLab version, patch to 19.4.2 / 19.3.5 / 19.2.8 or later, and check your logs. Related reading on recent maximum-urgency patch pushes: the VMware vCenter RCE flaw CVE-2026-59310 and the PHP RCE flaws tracked as CVE-2026-109618 and CVE-2026-109619 both followed a similar pattern of urgent vendor patches this fall.

Written bySana Qureshi

Sana Qureshi runs the security and privacy desk. She reports on actively exploited vulnerabilities, vendor patches and data breaches, and covers the password managers, VPNs and authentication tools readers use to protect themselves. Her alerts cite vendor advisories, CISA and the CVE record directly.

More from Sana QureshiAll Security & Privacy coverage