GitLab CE/EE: actively exploited flaw allows unauthenticated remote code execution

What happened

GitLab Community Edition (CE) and Enterprise Edition (EE) contain a vulnerability tracked as CVE-2026-97229. It is an integer overflow or wraparound caused by insufficient validation of regular expressions. An unauthenticated attacker can use a specially crafted regular expression in a CI/CD configuration to execute arbitrary code on the GitLab server.

The vulnerability has a CVSS base score of 10, the highest possible rating. CISA lists it in its Known Exploited Vulnerabilities catalog, which means it is being exploited in the wild. GitLab has published a patch release. The announcement for GitLab 19.4.2 is linked in the sources below.

Who is affected

You are affected if you run a self-managed GitLab CE or EE instance that has not yet received the vendor's fix. The source data does not list the exact affected and fixed versions for each release line. Check the GitLab patch release announcement linked below for your version.

The risk is highest for instances that are reachable from the internet, because no login is required to exploit the flaw. A successful attack gives the attacker code execution on the GitLab server. That server typically holds source code, CI/CD secrets, deploy keys and credentials for other systems.

If your GitLab instance is hosted by a provider, confirm with them that the fix has been applied.

What to do now

1. Identify every self-managed GitLab instance you or your customers run, including test and staging systems.
2. Back up the configuration and secrets before updating. On Omnibus installations this means at least /etc/gitlab/gitlab.rb and /etc/gitlab/gitlab-secrets.json. A data backup with sudo gitlab-backup create is also advisable.
3. Look up the fixed version for your release line in the GitLab patch release announcement linked below.
4. Update GitLab through your package manager, for example sudo apt update && sudo apt install gitlab-ee (or gitlab-ce) on Debian/Ubuntu, or the equivalent yum/dnf command on RHEL-based systems. For Docker installations, pull the patched image and recreate the container.
5. After the update, run sudo gitlab-ctl status to confirm that all services are running. Open the web interface to check that it responds normally.
6. If you cannot update immediately, restrict access to the instance from the internet, for example with a firewall or VPN, until the patch is installed.
7. Because the flaw is actively exploited, check exposed instances for signs of compromise, as described below. If you find any, rotate CI/CD variables, access tokens, deploy keys and runner registration tokens.

How to check whether you are affected

• Check the installed version with sudo gitlab-rake gitlab:env:info, or read /opt/gitlab/version-manifest.txt on Omnibus installations. In the web interface, the version is shown on the Help page. Compare it with the fixed versions in the vendor announcement.
• Review recent changes to CI/CD configuration files (.gitlab-ci.yml) and pipelines for unexpected or unusually complex regular expressions, especially from unknown users or projects.
• Inspect the GitLab logs under /var/log/gitlab/ for unusual activity. This includes gitlab-rails/production_json.log and the Sidekiq logs.
• Look for unknown processes, new user accounts, new SSH keys or personal access tokens, and unexpected outbound connections on the GitLab server.

Sources

• https://nvd.nist.gov/vuln/detail/CVE-2026-97229
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog