[Urgent] GitLab CVE-2026-97229: Added to CISA KEV on Oct 29 — Unauthenticated Code Execution Risk, Update to the Latest Patch Release (CVSS v3.1 10.0)

GitLab vulnerability CVE-2026-97229 (CVSS v3.1 10.0 CRITICAL) was added to CISA's KEV (Known Exploited Vulnerabilities) catalog on October 29, 2026. KEV lists vulnerabilities that have actually been exploited. The flaw could let an unauthenticated third party run arbitrary code on the GitLab server. If you run your own GitLab (self-managed), update to the latest patch release.

Note that moving to the October 12 fixed release (such as 19.4.2) is not enough. A second flaw of the same kind, CVE-2026-110264 (also CVSS 10.0), was fixed on October 21 and is not in the October 12 releases. GitLab says GitLab.com and GitLab Dedicated are already patched. This affects CE/EE that you install on your own servers (self-managed).

Where the score comes from: 10.0 (CVSS v3.1: network, low complexity, no privileges, no user interaction) is GitLab's own rating as the CNA, as listed in NVD. As of October 29 NVD showed the entry as "Undergoing Analysis", with no separate NIST score yet. GitLab's advisory also gives 10.0. CISA's KEV labels the flaw an integer overflow, which matches the weakness type in NVD (CWE-190).

What happened (what has been published)

• ▸Where: the code that handles regular expressions in GitLab's CI/CD configuration (pipeline settings). GitLab says a specially crafted regular expression could let an unauthenticated user run arbitrary code on the GitLab server ("under certain conditions")
• ▸Cause: GitLab titles it an integer overflow in the CI/CD regular expression compiler. Ruby's announcement describes an overflow in the size calculation of the compiled pattern
• ▸Exploitation: CISA added it to KEV on October 29. CISA does not say who exploited it, how often, or when. GitLab's October 12 advisory did not mention exploitation
• ▸Discovery: reported through GitLab's HackerOne bug bounty program. Attack details are not public, and this article does not give any

Affected versions and which version to move to

CVE-2026-97229 affects GitLab CE/EE in the 19.2, 19.3 and 19.4 series (19.2 before 19.2.8, 19.3 before 19.3.5, 19.4 before 19.4.2). However, the October 21 fix for the same kind of flaw, CVE-2026-110264, covers a much wider range, from 7.0 onward. So "I am older than 19.2, so this does not apply" is not a safe conclusion.

• ▸Minimum that fixes both (October 21 releases): 18.11.13 / 19.0.10 / 19.1.9 / 19.2.9 / 19.3.6 / 19.4.3 / 19.5.1
• ▸Latest, released October 29 (recommended): 18.11.14 / 19.0.11 / 19.1.10 / 19.2.10 / 19.3.7 / 19.4.5 / 19.5.3. The October 29 releases are for a different issue (CVE-2026-111943, distrust of compromised certificate authority certificates), but they are the newest release in each series and newer than the October 21 fixes
• ▸CVE-2026-110264: shown as "Analyzed" in NVD, also CVSS v3.1 10.0. CISA's assessment as of October 21 was "no exploitation". It is not in KEV (checked against the catalog updated October 29)
• ▸GitLab.com and GitLab Dedicated: GitLab says they are already patched (for Dedicated, through an internal release)

What to do today

• ✓★Check your GitLab version. After signing in, the `/help` page shows it. If it is older than the "latest" list above, you need to update
• ✓★Update to the latest patch release. A single-node install has downtime while it runs (GitLab does not start until its migrations finish). Multi-node installs can follow GitLab's zero-downtime procedure (per GitLab's advisory). Always confirm the steps on GitLab's official Update page
• ✓Start with any GitLab that is exposed to the internet. If yours is only reachable internally, that comes second (our own note)
• ✓Look for signs of attempted exploitation before and after updating. GitLab provides detection rules for self-managed environments (six for CVE-2026-97229, two for CVE-2026-110264, for example "Onigmo native worker crash"). CISA also asks for an initial forensic triage for KEV entries (a US federal agency requirement, not an obligation for businesses elsewhere)
• ✓Look beyond GitLab. The root of this flaw is in Ruby's regular expression engine (Onigmo). A Ruby app that builds regular expressions from user input also needs a Ruby update (next section)

If you cannot update right now

GitLab's advisories do not give a workaround other than updating (checked the October 12, 21 and 29 notices). Until you can update, reduce exposure as follows. This is our own note, not an official procedure.

• ▸Narrow who can reach it. Limit access with a VPN or IP restrictions
• ▸Keep outsiders from editing CI/CD configuration. If you accept public repositories or outside merge requests, review permissions
• ▸Keep logs from the period until you update. Save the detection results and your web server and application logs from before and after the update

This is also a problem in Ruby's regular expression engine

KEV's notes say other products can potentially be affected by the same underlying Ruby/Onigmo integer overflow. On October 23, Ruby announced fixed releases for four related CVEs (CVE-2026-89078, 93577, 97229 and 110264).

• ▸Fixed Ruby releases: 4.0.9 for the 4.0 series, 3.4.12 for 3.4, and 3.3.13 for 3.3, or later (Ruby's announcement)
• ▸When you are affected: when an app builds a regular expression from a string an attacker can control (`Regexp.new`, `Regexp.union`, `Regexp.compile`, or string interpolation). Ruby says apps that only use patterns written by their developers are not affected
• ▸Timeouts and length limits are not a reliable defense, according to Ruby. If you cannot update, Ruby's suggested workaround is to avoid building regular expressions from untrusted input
• ▸Ruby has not requested its own CVE IDs for these yet. Do not conclude "not vulnerable" from the Ruby version alone; check the advisories for the apps you run

What we could not confirm

• ▸The number, timing or actors of real attacks. CISA does not say. This article cannot show whether anyone in Japan was affected
• ▸Whether CVE-2026-110264 is being exploited. CISA's October 21 assessment was "no exploitation" and it is not in KEV (checked against the catalog updated October 29). That could change
• ▸What the "certain conditions" are. GitLab does not publish them; it says only that no login is required
• ▸A NIST-assigned score. NVD showed "Undergoing Analysis" on October 29. JVN iPedia was out of service when we checked

If you share this, share these 3 lines

• ▸GitLab vulnerability CVE-2026-97229 (CVSS v3.1 10.0) was added to CISA's Known Exploited Vulnerabilities catalog (KEV) on October 29. It can allow code execution on the server without logging in
• ▸★If you run your own GitLab, update to the latest patch release (19.5.3 / 19.4.5 / 19.3.7 / 19.2.10 and so on). The October 12 releases do not include the fix for the similar flaw (CVE-2026-110264) from October 21
• ▸Do internet-facing instances first. Also check for signs of suspicious access before and after updating

Pages used as sources