I’M UNDER A CYBER ATTACK

Alert

Alert 2026-131 Critical vulnerability in GitLab (CVE-2026-97229) allows RCE and is being actively exploited

Affected product(s): 

ProductAffected versionsFixed version
GitLab CE/EE 19.219.2.x versions earlier than 19.2.819.2.8 (19.2.9 recommended)
GitLab CE/EE 19.319.3.x versions earlier than 19.3.519.3.5 (19.3.6 recommended)
GitLab CE/EE 19.419.4.x versions earlier than 19.4.219.4.2 (19.4.3 recommended)

All self-managed deployment types are affected; GitLab.com and GitLab Dedicated have already been fixed and require no action.

Description

A maximum-severity vulnerability (CVSSv3.1 10 – CRITICAL) has been disclosed in GitLab Community Edition —CE— and Enterprise Edition —EE— that allows arbitrary code execution on the server through a specially crafted regular expression in the CI/CD configuration. It has been assigned CVE-2026-97229. The vulnerability is being actively exploited and public proofs of concept (PoC) exist.

The flaw is an integer overflow (CWE-190) in the size of a pattern compiled by Onigmo, the regular-expression engine for Ruby, which GitLab uses when processing CI/CD regular expressions. The same Ruby defect is also associated with CVE-2026-93577. The vendor fixed it in its Critical Patch Release dated 12/10/2026. According to the published PoCs, the code runs with the privileges of the server’s git user.

The vendor describes it as exploitable by an unauthenticated user. However, researchers point out that the public exploitation chain requires the ability to push code to a public project, for which a regular account, an access token, or open registration on the instance is sufficient; the final step is an unauthenticated GET request to /api/v4/projects/:id/ci/lint. Therefore, instances with open registration or public projects accessible from the Internet are the most exposed.

Exploitation attempts against the GitLab instance of an open-source project (Alpine Linux) were recorded on 20 and 21/10/2026, causing server process crashes, followed by additional failed attempts on 25 and 26/10/2026; the attacker used a newly registered account. There is no evidence that code execution succeeded, although the project treated the instance as compromised and warned that a successful exploitation may leave no crashes or traces in the web logs.

On 29/10/2026, the U.S. cybersecurity agency added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, with a remediation deadline of 01/11/2026.

This vulnerability is distinct from CVE-2026-110264, addressed in Alert 2026-118: the patches from 12/10/2026 for CVE-2026-97229 do not fix CVE-2026-110264.

Mitigation

The vendor does not offer an alternative solution (workaround), and limiting evaluation time (Regexp.timeout) or the length of regular expressions does not protect against this vulnerability. Until the update is applied, the following general recommendations apply:

  • Disable or restrict open user registration and review recently created accounts.
  • Restrict public projects and API access from the Internet where possible.
  • Review the logs for requests to /api/v4/projects/:id/ci/lint and for 502 errors or worker crashes following those requests, and apply the detections published by the vendor. The absence of these indicators does not rule out successful exploitation.
  • If there are signs of compromise, rotate the CI/CD tokens and secrets, runner tokens, and instance secrets (gitlab-secrets.json), along with passwords and keys.

Solution

The solution is to update each self-managed instance directly to the versions listed in Alert 2026-118, which include the fix for this vulnerability as well as for CVE-2026-110264:

  • Branches affected by CVE-2026-97229: 19.2.9, 19.3.6, 19.4.3, or 19.5.1, or later.
  • Remaining supported branches (affected by CVE-2026-110264): 18.11.13, 19.0.10, or 19.1.9.
  • Installations from source code or using a custom Ruby: also update Ruby to 3.3.13, 3.4.12, or 4.0.9, or later. The fix is a patch to Ruby that the vendor includes in its official packages and images, so updating GitLab alone is insufficient: an instance updated to 19.3.6 with a custom Ruby remained vulnerable.
  • GitLab.com and GitLab Dedicated have already been fixed and require no action.

Priority should be given to instances exposed to the Internet or with open registration, without overlooking internal servers.

Additional information: