Quick one, because the clock is short. CISA added GitLab CVE-2026-97229 to its Known Exploited Vulnerabilities catalog on October 29, with a federal deadline of Sunday, November 1 and a forensic triage requirement under BOD 26-04. If you run self-managed GitLab, this is your weekend.
What It Is
- The bug: an integer overflow in GitLab's CI/CD regular expression compiler, the piece that parses and evaluates regexes in pipeline configuration. A crafted expression can lead to code execution on the server. GitLab says that "under certain conditions" an unauthenticated user can pull it off.
- Severity: GitLab rated it CVSS 10.0.
- Affected: GitLab Community and Enterprise Edition on the 19.2, 19.3 and 19.4 branches before the October 12 patch releases.
- Fixed: 19.4.2, 19.3.5 and 19.2.8. (One write-up lists 19.3.4 for the 19.3 branch, so just take the latest patch for your branch and stop worrying about it.)
- Credit: reported by the researcher known as joaxcar.
What We Don't Know
CISA confirms active exploitation but hasn't said who, how many, or against whom, and lists ransomware use as unknown. Shadowserver tracks nearly 2,800 internet-exposed GitLab CE instances. BleepingComputer also mentions a separate GitLab regex compiler flaw from this month, CVE-2026-110264. It's not clear how the two relate, so don't assume one patch covers both. Check that you're on the current release.
Why It Matters More Than a Typical Web App Bug
A GitLab server isn't just another web app. It holds your source code, your CI/CD secrets, your deploy keys and, often, runner tokens that reach production. Code execution there is a software supply chain problem, not just a server problem. If someone owned it, the question isn't only "what did they read?" It's "what did they change, and what did my pipeline ship since?"
That's also why I keep telling customers to get developer infrastructure off the open internet. Your engineers need to reach GitLab. The internet doesn't.
What To Do
- Upgrade today to the latest patch for your branch (19.4.2, 19.3.5, 19.2.8 or later). GitLab.com customers don't need to do anything for the server itself.
- Use the threat detections GitLab released for self-managed instances.
- Hunt, don't just patch. Review recent changes to
.gitlab-ci.ymlfiles, new or changed users, access tokens and runners, and unusual pipeline runs since early October. - If you find anything, rotate CI/CD variables, deploy keys and runner tokens, and review what your pipelines shipped.
- Shrink the exposure. Put self-managed GitLab behind zero trust access instead of a public login page.
Bottom Line
A CVSS 10 in the system that builds your software, now exploited, with a Sunday deadline. Patch it, then go look for footprints.
Sources: BleepingComputer, Cyber Security News, GitLab 19.4.2 patch release, and CISA alert