Critical GitLab flaw allows unauthenticated RCE
Archived — this story has rotated out of today’s deck. It is kept here in full.
The gist
GitLab released fixes for CVE-2026-97229, a CVSS 10.0 regex compiler flaw, plus 23 other bugs.
Self-managed GitLab servers holding source code and pipeline secrets are the ones at risk.
Background
GitLab Inc. develops GitLab, an open-source repository management system that uses Git as its code management tool and lets users reach public or private projects through a web interface. The flaw, CVE-2026-97229, is an integer overflow in the regular expression compiler GitLab uses for CI/CD (continuous integration/delivery pipelines), caused by weak validation of those expressions; it needs no login and allows remote code execution on the server holding source code, pipeline definitions and pipeline secrets. It is reported to affect 12 years of GitLab releases, which is why it is drawing attention now.
How it unfolded
- Oct 14, 2026GitLab releases a security update fixing CVE-2026-97229, a CVSS 10.0 integer overflow in the regex compiler used for CI/CD, plus 23 other vulnerabilities.
- Oct 15, 2026NSFOCUS CERT publishes a notice on CVE-2026-97229, stating that vulnerability details and a PoC (proof-of-concept exploit) have been made public.
- Oct 21, 2026The Hacker News publishes a report on the critical GitLab flaw that could allow unauthenticated RCE across 12 years of releases.
Who’s saying what
- Official
- GitLab says an unauthenticated user could run arbitrary code by placing a crafted regular expression in a CI/CD configuration, and tells self-managed customers to upgrade to 19.4.2, 19.3.5 or 19.2.8 depending on their branch.
- Caution
- NSFOCUS CERT says attackers need access to the CI Lint interface of a public project and write permissions, and advises affected users to upgrade as soon as possible or restrict system access if they cannot.
Still unverified
NSFOCUS CERT states that vulnerability details and a PoC for CVE-2026-97229 have been made public.