Critical GitLab flaw (CVSS 10) is being exploited: who is affected and how to patch
A maximum-severity GitLab vulnerability, CVE-2026-97229, is now on the US government's list of actively exploited flaws. Here's who is affected, which versions to install, and why updating GitLab alone may not be enough.
If your team runs its own GitLab server, this needs your attention now. A maximum-severity vulnerability, CVE-2026-97229, rated 10.0 out of 10, is being actively exploited, according to the US Cybersecurity and Infrastructure Security Agency (CISA).
What is the flaw?
GitLab is a popular platform for storing code and running automated build pipelines (CI/CD). The bug is in how GitLab handles regular expressions (text-matching patterns) inside CI/CD configuration files.
In simple terms: an attacker can submit a specially crafted pattern that passes GitLab’s safety checks, but causes an integer overflow when processed later. This can let them run their own commands on the GitLab server, known as remote code execution (RCE).
Who is affected?
- Self-managed GitLab servers (Community Edition and Enterprise Edition), across all deployment types
- Not affected: GitLab.com (already patched) and GitLab Dedicated (no action needed)
Security firm Rapid7 found that in practice, an attacker needs to be able to commit files to a public project. That’s easy on servers where anyone can sign up and create projects, which makes those servers the highest risk.
Is it being exploited?
- CISA added it to its Known Exploited Vulnerabilities catalog on October 29, 2026, and told US federal agencies to patch by November 1.
- Alpine Linux reported that a newly registered account sent crafted configurations to its GitLab server on October 20–21, crashing worker processes eight times. Alpine found no proof the attack succeeded, but rebuilt its server, reset passwords and replaced secret keys to be safe. It found no tampering with its software packages.
- Rapid7 published proof-of-concept code on October 13, so attackers have had time to study it.
A CVSS score of 10 means the worst case: remote, easy to attack and complete control. When it’s also being exploited, patching can’t wait for the next maintenance window.
Which version should you install?
There’s a catch: GitLab also fixed a second CVSS 10 flaw, CVE-2026-110264, in its October 21 releases. The first round of patches doesn’t fix it. So install at least:
- 19.4.3 (if you’re on 19.4)
- 19.3.6 (if you’re on 19.3)
- 19.2.9 (if you’re on 19.2)
Or upgrade to the newest release available on your branch.
Why updating GitLab alone may not be enough
The bug is actually in Onigmo, the text-matching engine built into the Ruby programming language. GitLab’s official packages and container images include a fixed Ruby. But if you installed Ruby separately (as Alpine did) or build your own images, you must also update Ruby to 3.3.13, 3.4.12, 4.0.9 or later. Ruby 3.2 is end-of-life and won’t be fixed.
Step-by-step: what to do now
- Check your GitLab version (Admin Area → Dashboard, or the Help page).
- Upgrade immediately to 19.4.3 / 19.3.6 / 19.2.9 or newer.
- If you use your own Ruby, update it to a fixed version.
- Can’t upgrade today? Temporarily turn off public sign-ups, restrict anonymous access to public projects, and stop untrusted users from creating or writing to public projects. This only reduces risk; it doesn’t fix the flaw.
- Look for signs of attack: unexpected worker crashes, strange CI configurations in public projects, and new unknown accounts. Use GitLab’s published detection rules.
- If you find signs of compromise: treat the server as hacked. Rotate secrets, tokens and keys, and consider rebuilding.
Why it matters
GitLab servers hold a company’s source code, secrets and build pipelines. A compromised server can lead to stolen code or poisoned software sent to customers. This follows other serious attacks on developer tools this month. Read: AI coding agents tricked into installing malware and patch now: MLflow and Google MCP Toolbox.
Frequently asked questions
What is CVE-2026-97229?
A critical (CVSS 10.0) GitLab flaw in how CI/CD regular expressions are processed, which can allow remote code execution on self-managed servers.
Is GitLab.com affected?
No. GitLab.com has been patched, and GitLab Dedicated customers don’t need to do anything.
Which GitLab version fixes it?
19.4.2, 19.3.5 and 19.2.8 fix this flaw, but you should install 19.4.3, 19.3.6 or 19.2.9 (or newer) to also fix CVE-2026-110264.
Is this vulnerability being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities list on October 29, 2026.
