Over 1,000 GitLab servers vulnerable to ongoing RCE attacks

What it is

CVE-2026-97229 is a maximum-severity integer overflow in the CI/CD Regular Expression Compiler of GitLab CE and EE. GitLab says that under certain conditions an unauthenticated user could run arbitrary code on the server through a crafted regular expression in a CI/CD configuration, because regex validation was insufficient. CISA confirmed exploitation in the wild and added it to the KEV catalog.

Preconditions / Affected

• Only self-managed installations need action. GitLab.com already runs the patched version, and GitLab Dedicated customers need to do nothing.
• GitLab released the fix on 12 October 2026 in 19.4.2, 19.3.5 and 19.2.8, and recommends upgrading to one of them immediately.
• The page does not say which earlier versions are affected, or what "certain conditions" means.

What to do

Upgrade to 19.4.2, 19.3.5 or 19.2.8, depending on your release line. CISA ordered federal agencies to secure their servers by the Sunday after it listed the flaw. The page gives no workaround and no detection guidance.

Check your patch level against a second bug as well. CVE-2026-110264 is another maximum-severity Regular Expression Compiler flaw that allows arbitrary code execution. GitLab fixed it the month before, and Shadowserver counts over 11,300 instances still vulnerable to it, out of about 39,000 GitLab instances it sees daily. That is a far larger exposed group than the 1,000 for CVE-2026-97229. The page does not give the fixed versions for CVE-2026-110264.

Context from the page

Other GitLab flaws from 2026 that the page lists:

• CVE-2026-0723 (January): a high-severity two-factor authentication bypass.
• CVE-2026-85706 (September): a maximum-severity flaw in the repository commits API that can be exploited to steal credentials and other secrets. CISA flagged it as actively abused after watchTowr reported attackers scanning for vulnerable servers.

CISA has added six GitLab flaws to KEV since November 2021, and one of them has been used in ransomware attacks.

Caveats

The page reports exploitation only through CISA's KEV listing and Shadowserver's scan counts. It describes no attack chain, indicators of compromise or payloads. Shadowserver's figures come from internet-exposed instances it can see, so internal servers are not counted.