Can someone exploit CVE-2026-97229 without an account?

Yes. NVD describes it as exploitable by an unauthenticated user, and the CVSS vector shows no privileges required and no user interaction. The attacker uses a specially crafted regular expression in a CI/CD configuration. That is why internet-facing instances are the most urgent.

What does the CISA KEV listing mean for my company?

KEV lists vulnerabilities with known exploitation. The federal due date is 2026-11-01, and CISA's required action is to apply vendor mitigations under BOD 26-04 and follow its forensics triage requirements. Private companies are not bound by that date, but it is a useful priority signal.

Is a firewall rule enough instead of upgrading?

The sources list no vendor workaround, so upgrading is the fix. Restricting access can reduce exposure while you prepare the upgrade. CISA says to follow vendor instructions or stop using the product if mitigations are unavailable.

How do I know if my GitLab server was already compromised?

Preserve your logs first. Then review admin accounts, recent changes to CI configuration files, runner registrations and unexpected processes under the GitLab service user. If anything looks wrong, rotate CI/CD variables, tokens and deploy keys and start a formal incident response.

CVE-2026-97229 GitLab CE and EE Vulnerability: Patch Now

Q: Do I need to patch GitLab.com or GitLab Dedicated?

No. GitLab says GitLab.com already runs the patched version. It also says all GitLab Dedicated tenants were patched with an internal release before the public patch release. Self-managed installs are the ones you must upgrade.

What happened

GitLab fixed a critical bug, CVE-2026-97229, in GitLab Community Edition (CE) and Enterprise Edition (EE). Under certain conditions, an unauthenticated user could run arbitrary code on the GitLab server through a specially crafted regular expression in a CI/CD configuration. The cause is insufficient regular expression validation, and the weakness is tracked as CWE-190 (integer overflow or wraparound).

GitLab shipped the fix on October 12, 2026, in a critical patch release. NVD published the record on 2026-10-13. GitLab's advisory title for it is "Integer Overflow issue in CI/CD Regular Expression Compiler impacts GitLab CE/EE." (NVD, GitLab advisory)

Which GitLab versions are affected

NVD lists three affected branches. Each has a fixed release.

Branch	Affected versions	Fixed in
19.2	19.2 before 19.2.8	`19.2.8`
19.3	19.3 before 19.3.5	`19.3.5`
19.4	19.4 before 19.4.2	`19.4.2`

This affects self-managed installs. GitLab says GitLab.com is already running the patched version. It also says all GitLab Dedicated tenants were patched with an internal release before the public patch release.

If you run 19.3.4, note that GitLab says it had a bug affecting merge request pages when the Ona integration was enabled. Moving to 19.3.5 fixes that too.

How serious it is and whether it is exploited

NVD scores it 10 CRITICAL, with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. In plain terms: it works over the network, it is easy to trigger, it needs no login and no user action, and it can hit confidentiality, integrity and availability.

CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on 2026-10-29. The federal due date is 2026-11-01. Known ransomware use is listed as unknown.

Treat this as active exploitation. A GitLab server often holds source code, CI variables, deploy keys and tokens. Code execution on it can expose all of them.

Check your version and exposure

Start by finding out what you run. Pick the command that matches your install.

# Linux package (Omnibus) install
sudo gitlab-rake gitlab:env:info
cat /opt/gitlab/embedded/service/gitlab-rails/VERSION

# Docker install (replace gitlab with your container name)
docker exec -it gitlab cat /opt/gitlab/embedded/service/gitlab-rails/VERSION

# Helm install
helm list -A | grep -i gitlab

Compare the result with the table above. Anything below 19.2.8, 19.3.5 or 19.4.2 on its branch needs the upgrade.

Next, work out who can reach the server. CISA says stakeholders must evaluate each asset's internet exposure. Check your firewall or load balancer rules for ports 80 and 443 to the GitLab host. An instance open to the internet is the first one to fix.

Patch now, then look for signs of abuse

Follow these steps in order.

Take a backup and a VM snapshot before you change anything.
Upgrade to the fixed release for your branch: 19.2.8, 19.3.5 or 19.4.2.
Re-run the version check and confirm the new number.
Rotate secrets if you suspect abuse: CI/CD variables, runner tokens, deploy keys and personal access tokens.

GitLab's advisory strongly recommends upgrading all self-managed installs immediately. If you cannot upgrade today, the sources list no workaround. CISA's guidance is to follow vendor instructions or stop using the product if mitigations are unavailable. In practice, that means taking the instance off the internet until it is patched.

CISA's required action also points to its "Forensics Triage Requirements." So do not only patch. Preserve logs before you rotate or rebuild anything.

These checks are a starting point. They are not proof of a clean system.

# Which admin accounts exist, and when were they created?
sudo gitlab-rails runner 'User.admins.each { |u| puts "#{u.username} #{u.created_at}" }'

# Which CI files use regular expression matching in rules?
grep -rnE '=~|!~' --include='.gitlab-ci.yml' /path/to/checked-out/repos

# Recent web and API activity in the Rails log
sudo less /var/log/gitlab/gitlab-rails/production_json.log

Look for admin accounts you do not recognize and CI files changed by unfamiliar users. Also look for odd runner registrations, and unexpected processes spawned by the GitLab service user.

Worked example

Say your instance reports 19.3.4 and sits behind a public reverse proxy. You are on an affected branch, and you are exposed. Upgrade to 19.3.5, which is the fix for that branch, and confirm the version afterward. Then review admin users and recent CI changes, and keep the pre-patch logs.

Other fixes in the same release

The same advisory lists more security fixes. These include High-severity issues such as CVE-2026-92883 (cross-site scripting in syntax highlighting), CVE-2026-16301 (improper authorization in downstream pipeline creation) and CVE-2026-14814 (permissive regular expression in repository file access). One upgrade covers all of them, which is another reason not to wait.

What IT and security learners can take from this

This bug shows why input validation matters, even for something as small as a regular expression. It also shows why CI/CD systems are high-value targets: they hold secrets and can reach production. Learners can practice by inventorying internet-facing developer tools, reading CVSS vectors, and tracking KEV entries. Our How to Study for CompTIA Security+ guide covers vulnerability management and patching basics. You can also browse our cybersecurity certification pages.

Check your GitLab version today, then patch.