CISA Adds Critical GitLab Vulnerability CVE-2026-97229 to Actively Exploited List
CISA has added the critical CVE-2026-97229 vulnerability in GitLab CE and EE to its Known Exploited Vulnerabilities catalog. Fixed versions have been available since October 12.
CVE-2026-97229 GitLab is a critical vulnerability that the U.S. agency CISA added to the Known Exploited Vulnerabilities (KEV) catalog on October 29, 2026. The listing means that, according to CISA, the flaw in GitLab Community Edition and Enterprise Edition is being actively exploited. GitLab gives it the highest CVSS rating of 10.0.
The flaw affects the processing of regular expressions in CI/CD configuration. It is an integer overflow that, under certain circumstances, could have allowed an unauthenticated attacker to execute arbitrary code on the server through a modified regular expression in the CI/CD configuration.
CVE-2026-97229 GitLab: Fixed Versions Released
GitLab released fixes on October 12 in versions 19.2.8, 19.3.5, and 19.4.2. Operators of self-managed GitLab servers should verify that they are using one of the fixed versions or a newer one. According to the vendor, GitLab.com and GitLab Dedicated were fixed before the vulnerability was disclosed.
The CISA record lists November 1, 2026, as the remediation deadline. The KEV catalog tracks vulnerabilities for which there is evidence of exploitation in real-world attacks, increasing the urgency of updating compared with flaws without known exploitation.
Alpine Linux Recorded an Exploitation Attempt
Alpine Linux disclosed that an attacker attempted to exploit its GitLab instance on October 20 and 21. The organization found no evidence that code was successfully executed. However, it could not completely rule out that possibility, so it fully rebuilt the system.
This case represents a documented exploitation attempt, not a confirmed successful breach. CISA has not disclosed technical indicators of compromise, the scope of the campaign, the attackers’ identity, or the number of potentially affected organizations.
Risk to Self-Managed GitLab Servers
Self-managed GitLab servers may contain source code, CI/CD variables and secrets, access tokens, and other credentials used in software development and deployment. The possibility of remote code execution therefore represents a serious risk to an organization’s development and deployment environment.
Alpine Linux also highlighted a specific case involving custom GitLab builds or containers with an unofficial version of Ruby. In such deployments, updating GitLab alone may not eliminate the risk if the relevant Ruby dependency is not also updated. Operators of custom images should therefore verify the status of this component as well.
Further developments will depend on whether CISA, GitLab, or other security teams disclose indicators of compromise and technical details about the recorded activity. It will also be important whether confirmed successful breaches emerge at other organizations.
Sources
- CISA Known Exploited Vulnerabilities Catalog – Confirms the addition of CVE-2026-97229 to the KEV catalog on October 29, 2026, its known exploitation status, and the November 1 remediation deadline.
- GitLab Docs – Critical Patch Release: 19.4.2, 19.3.5, 19.2.8 – Describes the flaw’s impact, affected versions, and GitLab patch releases.
- CVE Program – CVE-2026-97229 – Confirms the CVE record, the CVSS 10.0 rating, the scope of affected versions, and the flaw description from the GitLab CNA.
- Alpine Linux – GitLab security incident: attempted exploitation of CVE-2026-97229 – Documents the exploitation attempt against Alpine Linux’s GitLab instance, the recovery steps taken, and the absence of evidence of successful code execution.
Verified and updated: October 30, 2026 06:20
