TLP:CLEARSECURITY ADVISORYHRK-SA-2026-1030-07Exploited in the wild
GitLab RCE (CVE-2026-97229): unauthenticated code execution through the CI/CD regex compiler
An integer overflow in GitLab's CI/CD regular expression compiler lets an unauthenticated user run code on the server through a crafted regex in a pipeline config. GitLab patched it on October 12; CISA added it to KEV on October 29. Upgrade to 19.2.8, 19.3.5 or 19.4.2, then prove the serving version.
SEVERITY
Critical
PEAK CVSS
10.0
AUTH REQUIRED
None
PUBLIC POC
Not confirmed
PUBLISHED
Oct 30, 2026
REVISION
v1.0 · @Melly
Hayrok Research highlight
A regular expression is one of the most ordinary things in a software pipeline. It decides whether a job runs on the main branch. On a GitLab server, that harmless-looking pattern just became a way to take over the whole machine.
CVE-2026-97229 scores a perfect 10.0. An unauthenticated attacker sends a crafted regex inside a CI/CD configuration, overflows the compiler that parses it, and runs code in the GitLab server context. No login, no user interaction, no privileges.
GitLab sits at the center of modern software delivery: source code, pipeline secrets, deployment tokens, container registries. Code execution there is not one server lost, it is the keys to everything that server can reach. GitLab patched it on October 12; CISA added it to KEV on October 29 after an attacker probed Alpine Linux's own instance. The uncomfortable detail: this is the third regex-compiler flaw from the same researcher in a month, and the only one that needs no login.
01 · EXECUTIVE SUMMARY
Bottom line
Hayrok Research Lab is tracking a maximum-severity, unauthenticated remote code execution flaw in GitLab self-managed. A crafted regular expression in a CI/CD configuration overflows the regex compiler and reaches code execution in the GitLab server context. GitLab fixed it on Oct 12, and CISA added it to KEV on Oct 29. GitLab.com and Dedicated are already patched; self-managed instances must upgrade immediately, then prove the serving version.
KEY JUDGMENTS
01
CISA added CVE-2026-97229 to its KEV catalog on Oct 29, 2026, with a federal remediation deadline of Nov 1.Observed
02
Only self-managed GitLab is in scope. GitLab.com runs the patched version and GitLab Dedicated customers need no action.Assessed
03
An instance patched in late September to 19.4.1 is still vulnerable. Only 19.2.8, 19.3.5 and 19.4.2 or later carry the fix.Reproduced
04
A GitLab server holds source code, CI/CD variables, access tokens and registry credentials, so code execution there is a path into the wider estate.Assessed
04ReachableAn attacker can reach the instance over HTTP.
03 · THREAT ACTIVITY
Exploitation status and timeline
IN THE WILDObservedCISA KEV Oct 29, deadline Nov 1.
PUBLIC POCNot confirmedNo public PoC in vendor guidance.
MANAGED SAASNot affectedGitLab.com and Dedicated patched.
PATCHAvailable19.2.8, 19.3.5, 19.4.2 on Oct 12.
DISCLOSURE AND ACTIVITY TIMELINE · 2026
Sep 23GitLab fixes two related regex compiler flaws (CVE-2026-93577, CVE-2026-89078), both requiring authentication.
Oct 12GitLab releases 19.2.8, 19.3.5 and 19.4.2, fixing CVE-2026-97229 and five high-severity bugs.
Oct 29CISA adds CVE-2026-97229 to KEV, citing an exploitation attempt against Alpine Linux's instance, with a Nov 1 deadline.
04 · AFFECTED PRODUCTS
Affected and fixed versions
The fix spans all three supported branches. An instance updated only to 19.4.1 or 19.3.4 at the end of September does not carry it.
BRANCH
AFFECTED
FIXED IN
STATUS
GitLab CE/EE 19.4
before 19.4.2
19.4.2
Fixed
GitLab CE/EE 19.3
before 19.3.5
19.3.5
Fixed
GitLab CE/EE 19.2
before 19.2.8
19.2.8
Fixed
GitLab.com (SaaS)
not affected
already patched
Not affected
GitLab Dedicated
not affected
no action needed
Not affected
FALSE SENSE OF SAFETYA recent upgrade is not proof. GitLab 19.4.1 and 19.3.4 shipped in late September and do not contain this fix. Confirm the running version is 19.2.8, 19.3.5 or 19.4.2 or later.
05 · RECOMMENDED ACTIONS
What to do, in priority order
CriticalImmediately
Internet-facing self-managed GitLabUpgrade to 19.2.8, 19.3.5 or 19.4.2 now. Prioritize ahead of the Nov 1 deadline.
Instances on 19.4.1 or 19.3.4Treat as unpatched. These late-September releases do not carry the fix.
HighWithin 72 hours
All self-managed instancesUpgrade, including internal-only servers. The flaw needs no authentication.
CI/CD infrastructureSegment runners, registries and cloud credentials from the GitLab application server.
Secrets reachable from GitLabRotate CI/CD variables and access tokens if an unpatched instance was exposed.
HighBefore closing
Every instanceRecord the serving version and the reachability result as evidence.
WORKAROUNDS
Restrict public access. Limit who can reach the GitLab instance until patching is complete.Segment CI/CD. Separate the application server from runners, registries, cloud environments and internal services.Rotate exposed secrets. If an unpatched instance faced the internet, rotate CI/CD variables and tokens.No safe config toggle. There is no supported configuration that removes the flaw. Upgrading is the fix.
06 · DETECTION AND HUNTING
Observables and hunting queries
GitLab has not published CVE-specific indicators. These are hunting hypotheses, not confirmed indicators.
TYPE
OBSERVABLE
SOURCE
Request
Unusual unauthenticated requests tied to CI/CD configuration processing
GitLab and reverse proxy logs
Behavior
Unexpected access to CI/CD variables, credentials or deployment secrets
Unsecured Credentials: Container API and CI/CD variables
Assessed
08 · TECHNICAL ANALYSIS
Root cause and attack path
GitLab's CI/CD regular expression compiler parses, compiles and evaluates the regular expressions in a project's pipeline configuration, for example to gate a job on a branch name. CVE-2026-97229 is an integer overflow (CWE-190) in that compiler: a specially crafted regular expression wraps an internal size value, and insufficient validation lets the overflow reach memory the compiler should not touch. The result is arbitrary code execution in the GitLab server context, without authentication.
This is the third regex compiler flaw the same researcher reported in a month. The two September flaws, CVE-2026-93577 and CVE-2026-89078, required authentication; CVE-2026-97229 does not, which is why it scores a full 10.0. Because the compiler runs as part of CI/CD config handling, an attacker who reaches it inherits the server's access to source code, pipeline variables, tokens and registries.
A recent GitLab unauthenticated data-read flaw added to KEV. Shows the target history.
AssessedThree regex compiler flaws in a month, and the one that needs no login scores a perfect 10. The CI/CD config parser is now a proven attack surface on self-managed GitLab.
09 · VALIDATION
Confirm remediation
A changelog entry is not a verdict. Each instance should end with evidence: patched version in the serving process, not reachable, or exposed.
01
Read the serving version
From the running instance, not the deploy manifest.
This advisory will be updated as exploitation activity or vendor guidance changes.
12 · FAQ
Is CVE-2026-97229 being exploited?
CISA added it to the KEV catalog on October 29, 2026, citing an exploitation attempt against Alpine Linux's instance, with a federal deadline of November 1.
Which versions fix it?
GitLab 19.2.8, 19.3.5 and 19.4.2. Earlier September releases such as 19.4.1 and 19.3.4 do not contain the fix.
Is GitLab.com affected?
No. GitLab.com runs the patched version and GitLab Dedicated customers need no action. Only self-managed CE and EE are in scope.
Is there a workaround?
No supported configuration removes the flaw. Restrict access and segment CI/CD while you upgrade, then upgrade.
VALIDATE YOUR EXPOSURE
Prove your GitLab exposure
Hayrok maps your self-managed GitLab instances, reads the serving version, checks reachability, and tests whether an exposed instance leaked CI/CD secrets. Every result lands in Evidence Fabric.