A GitLab vulnerability rated 10.0 out of 10 could allow attackers to execute malicious code on affected servers, putting software development and deployment systems at risk.
GitLab released security updates on October 12, 2026, addressing 24 vulnerabilities in Community Edition (CE) and Enterprise Edition (EE). The most serious, CVE-2026-97229, could enable unauthenticated remote code execution under certain conditions. Administrators of affected self-managed installations are being urged to update immediately.
Security researchers have reproduced the exploit, confirming a practical attack path. Although attacks against organizations have not been confirmed, compromised GitLab servers could expose source code, credentials, and connected deployment infrastructure.
GitLab flaw exposes servers to remote code execution
GitLab's October 12 security advisory identifies an integer overflow in the continuous integration and continuous delivery (CI/CD) regular expression compiler. Insufficient validation could allow a specially crafted expression in a malicious CI/CD configuration to trigger arbitrary code execution.
The vulnerability has low attack complexity and requires neither authentication nor user interaction under its CVSS assessment.
Cybersecurity firm Rapid7 reproduced the exploit against an unpatched GitLab 19.4.1 CE instance. Researchers executed operating system commands with the privileges of the GitLab git user.
The demonstrated attack required malicious CI/CD configuration and a specially crafted repository path. On instances allowing public registration and project creation, attackers could meet these prerequisites by creating their own projects.
The exploit did not succeed against patched version 19.4.2. As of October 13, Rapid7 reported no confirmed exploitation of CVE-2026-97229 in the wild.
GitLab patched another critical vulnerability in August following observed exploitation attempts. Those attacks involved a separate flaw.
The October release also fixes CVE-2026-92883, a cross-site scripting vulnerability rated 8.7, and CVE-2026-16301, an authorization flaw rated 8.5 affecting protected-branch pipelines.
GitLab patches and security measures
GitLab identifies the following releases as fixes for CVE-2026-97229:
- GitLab 19.2: Version 19.2.8.
- GitLab 19.3: Version 19.3.5.
- GitLab 19.4: Version 19.4.2.
GitLab.com is already patched, and GitLab Dedicated customers need no action. Version 19.3.5 also corrects a merge request issue introduced in the superseded 19.3.4 release.
These versions address CVE-2026-97229, but administrators should not assume they resolve every vulnerability affecting their installation. GitLab's advisory also lists CVE-2026-84284 as affecting all 19.3 versions. Administrators should review the complete advisory and follow GitLab's guidance to install the latest supported security release.
Until updates are installed, restricting untrusted project access can reduce exposure to the demonstrated attack path. Additional safeguards can help contain a compromise but cannot replace patching.
Security teams should:
- Verify patch deployment: Inventory affected instances, prioritize internet-facing servers, and confirm successful upgrades.
- Restrict untrusted access: Disable unnecessary public registration and prevent untrusted users from creating or modifying public projects.
- Isolate development infrastructure: Segment GitLab servers and runners from sensitive networks and production systems.
- Protect CI/CD credentials: Enforce job token allowlists and least-privilege permissions; rotate potentially exposed credentials if compromise is suspected.
- Monitor suspicious activity: Investigate unexpected pipeline executions, repository changes, unusual server processes, and suspicious authentication attempts.
- Test incident response plans: Verify procedures for isolating compromised servers, preserving evidence, and restoring trusted configurations.
These controls also strengthen security across development toolchains, particularly where automated pipelines access sensitive infrastructure.
A separate compromise of Coder's module registry in September demonstrated how trusted development infrastructure can be abused to distribute malicious code. GitLab's central role in software delivery makes compromised servers a potential gateway to source code, credentials, and production systems. Patching vulnerable instances and restricting access to connected infrastructure can help contain the damage.
Read more: A separate GitLab vulnerability added to CISA's exploited vulnerabilities catalog in September highlights why investigating suspicious activity should accompany urgent patching.