Critical GitLab CI/CD Flaw Enables Unauthenticated Remote Code Execution
Summary
CVE-2026-97229 is a CVSS 10.0 integer overflow in GitLab’s CI/CD regular expression compiler that may allow unauthenticated code execution. GitLab patched affected self-managed versions; no confirmed in-the-wild exploitation was reported as of October 13, 2026.
Key points
- The flaw affects GitLab CE/EE versions before 19.2.8, 19.3.5, and 19.4.2 in their respective release branches.
- A specially crafted regular expression in a CI/CD configuration can trigger the integer overflow and potentially enable unauthenticated arbitrary code execution.
- GitLab recommends upgrading affected self-managed installations to 19.2.8, 19.3.5, 19.4.2, or a later supported release. GitLab.com instances are already secured; GitLab Dedicated requires no further action.
- The vendor has not disclosed the vulnerable function, request path, or complete exploit chain. No confirmed in-the-wild exploitation or reliable working proof of concept was reported as of October 13, 2026.
- Until patched, administrators are advised to restrict unnecessary public access and limit connectivity between GitLab, runners, registries, cloud environments, and internal services.
- Suggested hunting checks include unusual unauthenticated CI/CD requests, unexpected GitLab child processes, changes to users or tokens, and unusual outbound connections; these are hypotheses, not confirmed indicators.
Article Details
- Vulnerability Types
- Integer overflow or wraparound
- Severity
- Critical; CVSS 10.0
- Affected Versions
- GitLab CE/EE 19.2 before 19.2.8
- GitLab CE/EE 19.3 before 19.3.5
- GitLab CE/EE 19.4 before 19.4.2
- Exploitation Status
- not_reported
- Exploit Availability
- claimed_or_private
- Patch Status
- available
- Workarounds
- Until patching is complete, restrict unnecessary public access to GitLab, segment application servers from sensitive CI/CD infrastructure, and limit connectivity to runners, registries, cloud environments, and internal services. The article says no vendor-supported workaround replaces upgrading.