CISA confirms exploitation of critical GitLab RCE flaw

CISA added CVE-2026-97229, a critical remote code execution vulnerability in GitLab's CI/CD Regular Expression Compiler, to its Known Exploited Vulnerabilities catalog on Oct. 29 after confirming that attackers are exploiting it in the wild. Federal agencies were ordered to patch by Nov. 1 under Binding Operational Directive 26-04, and CISA also urged private sector security teams to prioritize the fix. GitLab had shipped patches on Oct. 12 in versions 19.4.2, 19.3.5 and 19.2.8 for Community Edition and Enterprise Edition. A researcher going by the handle 'joaxcar' reported the flaw.

The flaw comes from an integer overflow in the CI/CD Regular Expression Compiler, which handles regular expressions in pipeline configuration files. GitLab said the issue could have let an unauthenticated user run arbitrary code on its server via a specially crafted regular expression in a CI/CD configuration, because validation was insufficient. GitLab.com was already on the patched version, and the company said dedicated customers did not need to act. GitLab also released threat detections for self-managed customers after it detected attempted exploitation.

The Oct. 12 patches fix only CVE-2026-97229. A separate maximum-severity bug, CVE-2026-110264, also sits in the Regular Expression Compiler and allows unauthenticated remote code execution, but no exploitation of it has been confirmed yet, according to available reports. Both flaws carry a CVSS score of 10.0.

Shadowserver said on Sunday it tracks over 1,000 GitLab instances vulnerable to CVE-2026-97229 and over 11,300 instances vulnerable to CVE-2026-110264, from about 39,000 GitLab instances it sees each day. Nearly 30 percent of detectable installations are exposed to the second flaw.

GitLab released versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13 on Oct. 21 to address both vulnerabilities. Researchers advise reviewing CI/CD configurations and logs for suspicious regex patterns, and replacing tokens, deploy keys and other secrets. Shadowserver shares IP addresses of vulnerable instances through its Vulnerable HTTP report.

Since November 2021, CISA has added six GitLab flaws to its exploited list, and one of them has been used in ransomware attacks. Earlier in the year GitLab fixed a high-severity two-factor bypass, CVE-2026-0723, and a critical defect in the repository commits API, CVE-2026-85706, which CISA later added to its catalog after watchTowr saw scanning.

GitLab reports its DevSecOps platform has over 70 million registered users and serves more than half of the Fortune 100.