CVE-2026-97229 is an unauthenticated remote code execution flaw (CVSS 10.0) in self-managed GitLab CE/EE, triggered by a crafted regular expression in a CI/CD configuration. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on Oct 29, 2026, after Alpine Linux disclosed exploitation attempts against its GitLab instance; federal agencies have until Nov 1, 2026 to fix it. A second CVSS 10.0 regex flaw, CVE-2026-110264, was patched on Oct 21, so the version you need is the Oct 21 release, not the Oct 12 one.
What happened? (timeline)
- Oct 12, 2026 — GitLab releases 19.4.2, 19.3.5 and 19.2.8, fixing CVE-2026-97229 ("Integer Overflow in CI/CD Regular Expression Compiler"), reported by joaxcar via HackerOne. [GitLab]
- Oct 20–21, 2026 — An unknown actor tries to exploit the flaw against Alpine Linux's unpatched GitLab instance by sending crafted CI configurations. GitLab worker processes crash eight times; in four of those crashes the exploit fails at the next step. The actor also downloads Alpine's GitLab container image. [The Hacker News, citing Alpine]
- Oct 21, 2026 — GitLab releases 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13, fixing CVE-2026-110264, a separate CVSS 10.0 RCE in the regex compiler reachable through Org-mode (
.org) file rendering. [Censys, eSecurity Planet] - Oct 25–26, 2026 — Further attempts against Alpine are blocked. [The Hacker News]
- Oct 29, 2026 — CISA adds CVE-2026-97229 to KEV, alongside Cisco ASA/FTD CVE-2026-76418. FCEB deadline: Nov 1, 2026. [The Hacker News, CISA]
Alpine reported no evidence the attack succeeded but said it could not rule it out, so it "treated the instance as compromised" and rebuilt it from scratch. Alpine reported that its aports repository, packages and Oct 21 releases were not tampered with. [The Hacker News]
How does the CVE-2026-97229 exploit work?
GitLab's advisory: the issue "could have allowed an unauthenticated user to execute arbitrary code on the GitLab server" via "a specially crafted regular expression in a CI/CD configuration," caused by insufficient regular expression validation. CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. GitLab lists no workaround.
The Alpine attempts match this path: crafted CI configurations sent to the server, causing worker crashes. [The Hacker News]
For the sibling CVE-2026-110264, Censys reports that an attacker needs only one public project that can hold a crafted .org file, and that code runs as the git user, giving access to gitlab-secrets.json, all CI/CD variables, runner and access tokens, and read/write access to every repository on the instance. As of Oct 22, Censys knew of no in-the-wild exploitation and no public proof-of-concept for CVE-2026-110264. [Censys]
Our read: a GitLab server holds source code, pipeline secrets and runner tokens. Code execution on it is a software supply-chain position, not only a server compromise. Alpine's decision to rebuild after failed attempts is the right bar for any unpatched, internet-reachable instance.
Who is affected?
Self-managed GitLab CE and EE. GitLab.com and GitLab Dedicated are already patched. [GitLab]
| CVE | Affected | Fixed |
|---|---|---|
| CVE-2026-97229 (KEV) | 19.2 before 19.2.8; 19.3 before 19.3.5; 19.4 before 19.4.2 | 19.2.8, 19.3.5, 19.4.2 (Oct 12) |
| CVE-2026-110264 | 7.0–18.11.12; 19.0.0–19.0.9; 19.1.0–19.1.8; 19.2.0–19.2.8; 19.3.0–19.3.5; 19.4.0–19.4.2; 19.5.0 | 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3, 19.5.1 (Oct 21) |
The Oct 12 fixed versions (19.4.2, 19.3.5, 19.2.8) are still vulnerable to CVE-2026-110264. Censys counted 81,820 internet-visible GitLab hosts on Oct 21 and estimates over half of exposed servers run a release line more than seven months old with no fix of its own. [Censys]
What should CISOs do this week?
- Upgrade every self-managed GitLab to the Oct 21 fixed version for its branch (table above). Servers on unsupported lines must step through GitLab's required upgrade stops; some upgrades need database migrations and may cause downtime on single-node systems. [Censys, eSecurity Planet]
- Inventory instances you don't know about: team-run GitLab servers, test boxes, and container images. Use external attack surface data, not only the CMDB.
- Restrict public access to GitLab where feasible until patched. [eSecurity Planet]
- Hunt on any instance that was unpatched and reachable, using GitLab's detections (below) and host indicators.
- If any indicator appears, treat the instance as compromised: rotate
gitlab-secrets.jsoncontents, CI/CD variables, runner and access tokens, and review pipelines and repositories for changes. [Censys] - Track the Nov 1, 2026 KEV deadline even if you are not federal; CISA encourages all organisations to prioritise KEV entries.
Test yourself: how a red team would check exposure
- Version check, not exploitation. Enumerate GitLab hosts (internal and external) and compare the reported version against the fixed table. Censys's query for internet exposure:
host.services.software: (vendor: "gitlab" and product: "gitlab") or web.software: (vendor: "gitlab" and product: "gitlab"). - Detection validation. GitLab published six detections for CVE-2026-97229: Onigmo native worker crash, Graphql cilint hostile regexp, ci regexp oversized non ascii path, ci regexp guard rejection, ci lint workhorse worker crash, ci lint scripted client error burst. For CVE-2026-110264, eSecurity Planet lists "Onigmo native worker crash" and "Org mode render error burst." Confirm these alerts route to your SOC. GitLab notes they detect attacks but do not prevent them. [GitLab, eSecurity Planet]
- Host indicators (GitLab guidance via Censys): unexpected child processes of Puma; new files owned by
gitin/tmp; changed crontabs or SSH keys for thegituser. - Blast-radius review. List which secrets a
git-user compromise would expose on your instance (CI/CD variables, runner tokens, deploy keys) and which production systems they reach.
Lessons for the security program
- Two CVSS 10.0 regex RCEs in GitLab nine days apart means "patched on Oct 12" is not "patched." Track fixed versions per CVE, not per patch day.
- Source-control and CI servers belong in the tier with VPNs and firewalls for patch SLAs.
- Worker crash bursts were the visible signal at Alpine. Alert on application crash anomalies on code infrastructure.
- Pipeline secrets should be short-lived and scoped so a GitLab server compromise does not hand over production.
CISOs in the CISO Platform community are comparing GitLab patch status and CI/CD secret rotation plans this week. Join 6K+ security leaders →
FAQ
Is CVE-2026-97229 being exploited?
Yes. CISA added it to KEV on Oct 29, 2026 based on attack attempts disclosed by Alpine Linux on Oct 20–21. Alpine found no evidence of success but rebuilt its instance.
Which GitLab version fixes CVE-2026-97229?
19.2.8, 19.3.5 and 19.4.2. Install the Oct 21 releases (e.g., 19.4.3, 19.5.1) instead, which also fix CVE-2026-110264.
Is GitLab.com affected?
No. GitLab.com and GitLab Dedicated are already patched; only self-managed CE/EE instances need action.
Is there a workaround?
GitLab lists no workaround for CVE-2026-97229. Restricting public access reduces exposure but does not remove the flaw.
What can an attacker access after exploitation?
For the sibling CVE-2026-110264, Censys says code runs as the git user with access to gitlab-secrets.json, CI/CD variables, runner and access tokens, and all repositories.
Handled a GitLab compromise or run a red team against CI/CD? Write it up for CISO Platform peers →
Related on CISO Platform
- CVE-2026-76418: Exploited Cisco ASA/FTD VPN flaw crashes firewalls
- LiteLLM 1.107.0 supply-chain compromise: attack chain and payload
- PHP2Shell (CVE-2026-109618/109619) technical analysis
- Railway and Zeabur breaches: when your PaaS holds everyone's secrets
- Exploited this week: Plex2Shell, Arista, VeloCloud, Collabora
Sources
- GitLab, Patch release 19.4.2 (CVE-2026-97229): https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/
- GitLab, Patch release 19.5.1 (CVE-2026-110264): https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/
- CISA, Adds two known exploited vulnerabilities (Oct 29, 2026): https://www.cisa.gov/news-events/alerts/2026/10/29/cisa-adds-two-known-exploited-vulnerabilities-catalog
- The Hacker News, CISA Adds Actively Exploited GitLab RCE and Cisco Firewall DoS Flaws to KEV: https://thehackernews.com/2026/10/cisa-adds-actively-exploited-gitlab-rce.html
- SecurityWeek, Max-Severity GitLab Vulnerability Exploited Against Alpine Linux: https://www.securityweek.com/max-severity-gitlab-vulnerability-exploited-against-alpine-linux/
- Censys, CVE-2026-110264 advisory: https://censys.com/advisory/cve-2026-110264/
- eSecurity Planet, GitLab Patches Second 10.0 RCE Flaw in October: https://www.esecurityplanet.com/news/news-gitlab-critical-rce-patch-october/
- CERT-EU advisory 2026-019: https://www.cert.europa.eu/publications/security-advisories/2026-019/
Comments