www.it-connect.fr
GitLab Patches Critical Unauthenticated RCE Flaw in CI/CD Regex Engine (CVE-2026-97229)
10 out of 10. That’s a great score. But when it comes to a security flaw’s CVSS rating, it’s a bad sign. It matches a critical vulnerability (CVE-20026-97229) that GitLab has just patched in the regular expression compiler of its CI/CD system. It could allow an unauthenticated attacker to execute code on the server. Here’s how to stay protected.
On October 12, 2026, GitLab released a critical patch for GitLab Community Edition (CE) and Enterprise Edition (EE) in the form of three new versions: 19.4.2, 19.3.5 and 19.2.8. But beyond this critical flaw, the update fixes a total of 24 vulnerabilities: 5 high-severity, 14 medium-severity and 4 low-severity issues.
As for the critical flaw, tracked as CVE-2026-97229, it is an integer overflow in GitLab CI/CD’s regular expression compiler: the component that processes regex rules in pipeline configurations, for example to condition a job on a branch name.
"GitLab has fixed an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient validation of regular expressions", the security advisory states. And this vulnerability has all the hallmarks of a cybercriminal’s jackpot: remote exploitation, low complexity, no privileges required, no user interaction. Patching is the safest move.
However, even though the user does not need to be authenticated (which may come as a surprise), GitLab says the flaw is exploitable only under certain conditions, without specifying which ones.
Three Critical Regex Engine Flaws in Three Weeks
This vulnerability was reported by researcher joaxcar through GitLab’s bug bounty program on HackerOne. And it is not his first find in this area. On September 23, 2026, GitLab had already released versions 19.4.1, 19.3.3 and 19.2.7 to fix two critical flaws reported by the same researcher:
- CVE-2026-93577: an integer overflow while compiling a trapped regex in a CI/CD configuration.
- CVE-2026-89078: a double free while parsing a trapped regex, also in a CI/CD configuration.
There is still an important difference between CVE-2026-97229 and these two vulnerabilities: those required authentication.
Which GitLab Versions Are Affected?
The CVE-2026-97229 flaw affects GitLab CE and EE in the following versions:
- GitLab 19.2: all versions earlier than 19.2.8.
- GitLab 19.3: all versions earlier than 19.3.5.
- GitLab 19.4: all versions earlier than 19.4.2.
So, an instance updated to 19.4.1 at the end of September is still vulnerable! On the SaaS side, GitLab.com is already running a fixed version, and GitLab Dedicated customers do not need to take any action. For self-hosted instances, however, it is a different story: updating is the only option. "We strongly recommend that all self-managed GitLab installations be updated to one of these versions immediately", GitLab emphasizes. See this documentation page if you need help.
It is strongly recommended that you patch your GitLab instances. This is especially true because recent vulnerabilities have been quickly exploited and added to the CISA KEV catalog.
