GitLab CVSS 10.0 Flaw Enables Unauthenticated RCE
An integer overflow in GitLab's CI/CD config regex lets unauthenticated attackers run arbitrary code. Patches are available for all supported release lines.
Dave "Kilobaud" FerrisGitLab has patched a maximum-severity flaw affecting all supported editions of its DevSecOps platform. CVE-2026-97229 is an integer overflow in the CI/CD configuration regex validation layer. An unauthenticated remote attacker can execute arbitrary code on the server by supplying a crafted regular expression in a .gitlab-ci.yml file or pipeline configuration. CVSS 10.0.
Affected releases:
- GitLab CE and EE 19.2.x before 19.2.8
- GitLab CE and EE 19.3.x before 19.3.5
- GitLab CE and EE 19.4.x before 19.4.2
GitLab has shipped 19.4.2, 19.3.5, and 19.2.8. GitLab.com is already updated. Self-hosted instances require a manual upgrade.
The company reports no confirmed in-the-wild exploitation, though that status tends to change fast. When GitLab’s last CVSS 10.0 flaw dropped in September, Rapid7 was tracking active probes within hours of the advisory. CI/CD configuration inputs sit at a reachable surface in most GitLab deployment models, including instances with public projects or contributor-level external access.
Three more high-severity fixes in the same release
The same advisory addresses three additional flaws patched alongside CVE-2026-97229:
- CVE-2026-92883 (CVSS 8.7): cross-site scripting via a malicious repository
- CVE-2026-16301 (CVSS 8.5): improper authorization in downstream pipeline creation
- CVE-2026-14814 (CVSS 8.2): permissive regex enabling cached response poisoning
None carry the unauthenticated remote-code-execution reach of the lead CVE, but each widens the attack surface for an adversary already holding contributor or viewer access.
What to do
Upgrade to 19.4.2, 19.3.5, or 19.2.8. If your GitLab instance accepts CI/CD jobs from external contributors or public merge requests, this is a same-day patch. GitLab’s release documentation has full version tables and upgrade paths.
This is the fifth CVSS 9.0-or-above GitLab flaw since August, following the AI Gateway RCE and package registry bug. If your patch cycle for internal tooling runs quarterly, the math is not in your favor.
- [ CRITICAL ]CVE-2026-97229GitLab CI/CD regex integer overflow enables unauthenticated RCE
Found this useful? Share it.
