GitLab CE/EE: critical CVE-2026-97229 exploited in the wild

What it is and who is affectedCVE-2026-97229 is an integer overflow or wraparound flaw (CWE-190) in GitLab Community Edition and Enterprise Edition. A...

What it is and who is affected

CVE-2026-97229 is an integer overflow or wraparound flaw (CWE-190) in GitLab Community Edition and Enterprise Edition. According to the NVD entry published on 13 October 2026, insufficient validation of regular expressions allows an unauthenticated user to execute arbitrary code on the GitLab server by submitting a specially crafted regular expression inside a CI/CD configuration.

The severity is as high as it gets: CVSS 3.1 score of 10, rated critical, with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. In plain terms, the attack travels over the network, needs no credentials and no user interaction, and compromises confidentiality, integrity and availability.

The affected ranges, as listed by NVD, are:

GitLab versions from 19.2.0 included up to 19.2.8 excluded.
GitLab versions from 19.3.0 included up to 19.3.5 excluded.
GitLab versions from 19.4.0 included up to 19.4.2 excluded.

Any organisation running a self-managed GitLab instance in one of those ranges is exposed, whether it is a development team in Barcelona, an ecommerce operation in Lleida or a small IT department in Girona managing its own server. The CI/CD pipeline is precisely the part of GitLab that tends to be reachable from outside, which widens the practical risk.

Why it is urgent

This is not a theoretical flaw waiting for a proof of concept. CISA added CVE-2026-97229 to its Known Exploited Vulnerabilities (KEV) catalogue on 29 October 2026, which means it has already been observed in real attacks. The agency gave US federal agencies until 1 November 2026 to apply mitigations following the vendor's instructions, in line with BOD 26-04 and its forensics triage requirements.

There is no record of the vulnerability being used in ransomware campaigns so far, but that detail should not invite complacency. A critical, unauthenticated remote code execution bug in a platform that holds source code, secrets and deployment credentials is exactly the kind of entry point that attackers monetise later. The gap between KEV listing and mass scanning is usually measured in hours, not weeks.

What to do today

The first step is inventory: confirm whether your organisation runs GitLab CE or EE, whether it is self-managed or a cloud service, and which exact version is deployed. Version numbers are often buried in an admin panel or a release file, so it is worth asking whoever maintains the instance rather than assuming.

If you are inside an affected range, apply the update indicated in GitLab's own advisory. The vendor published patch release notes for 19.4.2, and that notice is the authoritative source for the fixed versions and for any interim mitigation. Do not rely on third-party summaries for the exact remediation steps.

Alongside patching, it is worth reviewing whether the instance shows signs of intrusion: unexpected CI/CD jobs, unfamiliar pipeline configurations, anomalous outbound connections or new accounts with elevated permissions. Reducing what is exposed to the internet also helps: pipelines and administrative interfaces that do not need to be publicly reachable should sit behind a VPN or an IP allowlist. CISA itself puts the responsibility on each organisation to evaluate the internet exposure of its assets.

Finally, treat this as a reminder of a broader pattern. CI/CD platforms concentrate privilege, which makes them a high-value target and a frequent source of critical CVEs. Keeping them patched, monitored and hardened is not optional housekeeping.

How a cybersecurity team like ALMC's can help

For SMEs, online shops and companies with a small IT team, keeping track of advisories like this one while running the business is a stretch. At ALMC we work on exactly that gap: security audits and pentesting to find vulnerabilities before someone exploits them, server hardening, monitoring and incident response, and maintenance and updating of the platforms our clients depend on, including WordPress, PrestaShop and Joomla installations, as well as recovery of websites that have already been compromised.

When a critical CVE lands in the KEV catalogue, the difference between a contained incident and a serious breach is usually how quickly someone checks the inventory, applies the vendor's fix and reviews the logs. That work can be done in-house, but it needs someone watching the advisories continuously and knowing where every instance lives. Many companies in Catalonia find it more practical to hand that watch to a team that does it every day, under GDPR-compliant processes and with a clear record of what was patched and when.

Is your business exposed to flaws like this?

ALMC checks which versions you are running, applies the patches and hardens your servers and website. Contact our team for a security review.

Results without leaving the page.