Critical GitLab RCE Lets Unauthenticated Attackers Execute Code on Servers (CVE-2026-97229)

What it is

CVE-2026-97229 is a CVSS 10.0 integer overflow (CWE-190) in the CI/CD regular expression compiler of GitLab CE and EE. It gives OS-level code execution as the git user on the GitLab server.

How it works

The parser that compiles regular expressions from pipeline configuration overflows and corrupts memory. The trigger is a crafted regex committed in .gitlab-ci.yml, combined with a repository path containing UTF-8 characters. The page does not say more about the overflow itself.

The page names the post-exploitation consequences:

• exfiltrating CI/CD variables (secrets) and source code
• compromising build pipelines
• lateral movement into cloud workloads deployed from those pipelines

Preconditions / Affected

• Self-managed CE/EE on 19.2 before 19.2.8, 19.3 before 19.3.5, or 19.4 before 19.4.2.
• No authentication is needed if the instance allows public project creation or user self-registration. Internet-facing instances with these settings are the highest risk.
• GitLab.com (SaaS) is already patched, and GitLab Dedicated customers need no action.

flowchart TD
    A[Attacker commits crafted regex + UTF-8 path] --> B{Can attacker create or write a project?}
    B -->|Public creation or self-registration open| C[Code execution as git user]
    B -->|Registration and public writes closed| D[Blocked for anonymous users]
    C --> E[CI/CD secrets, source, cloud pivot]

What to do

1. Upgrade to 19.4.2, 19.3.5, or 19.2.8, matching your branch. GitLab has published no workaround.
2. If you cannot patch immediately, apply these interim mitigations: - restrict anonymous access to public projects - stop untrusted users from creating or writing to public projects - disable user self-registration where it is not needed
3. Review recent CI/CD configuration changes for unexpected or suspicious regular expressions.
4. Rotate CI/CD secrets if you suspect compromise.

The page gives no commands or detection queries.

Caveats

• Rapid7 independently reproduced the bug with a public proof-of-concept against an unpatched official GitLab CE 19.4.1 image with ASLR enabled, so exploit code exists.
• The page reports no confirmed in-the-wild exploitation. It cites the earlier max-severity GitLab flaw CVE-2026-85706, which was probed within hours of disclosure and later added to CISA KEV, as a reason to expect fast weaponization.
• The interim mitigations only narrow who can reach the bug; they are not a fix. Users who are already authorized to create or write projects can still exploit it.