GitLab CVE-2026-97229: CVSS 10.0 unauthenticated RCE in the CI/CD regex compiler

GitLab shipped patch releases 19.4.2, 19.3.4 and 19.2.8 on October 12, 2026, and the headline fix is as bad as the score gets: CVE-2026-97229, a CVSS 10.0 flaw that lets an unauthenticated attacker execute arbitrary code on a self-managed GitLab server. The mechanism is an integer overflow in the CI/CD regular-expression compiler: a specially crafted regex in a CI/CD configuration overflows internal bounds and lands as code execution on the host. GitLab.com is already patched and GitLab Dedicated needs no action — but every self-managed CE/EE instance is exposed until it upgrades.

Developing story — first published 15:04 CEST (13:04 UTC), October 12, 2026. Updated as the vendor and CISA publish more.

At a glance

CVE	CVE-2026-97229
Product / affected versions	GitLab CE/EE self-managed · 19.2 before 19.2.8 · 19.3 before 19.3.4 · 19.4 before 19.4.2
Fixed in	19.4.2 · 19.3.4 · 19.2.8 — released October 12, 2026
CVSS	10.0 Critical · CVSS 3.1 · scored by GitLab (CNA) · AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Exploited in the wild	No evidence stated by GitLab or CERT-EU as of October 12, 2026
CISA KEV	Not listed (catalog version 2026.10.08)
Public PoC	None public as of October 12, 2026
Official advisory	GitLab patch release 19.4.2

Why a CVSS 10.0 in GitLab is worse than a 10.0 anywhere else

A GitLab server is not an application sitting next to the crown jewels — for most engineering organizations it is the crown jewels. It holds the source, the CI/CD pipeline definitions, the deploy keys, the registry credentials, the cloud tokens the runners assume, and the signing material for releases. An unauthenticated RCE on that box is a software-supply-chain breach by another name: whoever runs code there can read every repository, forge commits, poison build artifacts, and pivot into every environment the runners can reach.

The vector string earns the full score honestly. PR:N means no credentials. AC:L means no race, no exotic preconditions. S:C — scope changed — means the blast radius leaves the vulnerable component and reaches the whole host and the trust relationships around it. This is the profile attackers scan the internet for, and self-managed GitLab instances are frequently internet-facing by design because that is how remote developers and external contributors reach them.

The CI/CD regex compiler is now a repeat offender

Here is the part that should change how you treat this patch. Three weeks earlier, GitLab fixed CVE-2026-93577 in the same CI/CD regular-expression compiler — also an integer overflow leading to arbitrary code execution, scored CVSS 9.9, and shipped in 19.4.1 / 19.3.3 / 19.2.7. The one material difference between that bug and this one is the line that matters most: CVE-2026-93577 required an authenticated user; CVE-2026-97229 does not.

"We patched the regex compiler last sprint." "You patched a regex-compiler bug last sprint. This is a different CVE in the same component, and this one needs no login."

Two critical integer-overflow bugs in one compiler, three weeks apart, with the privilege requirement falling from "authenticated" to "none," is not a coincidence you get to file and forget. It is a signal that the parser handling untrusted regular expressions is a soft surface, and that "we applied the September patch" is not the same claim as "that code path is no longer reachable by an anonymous request on our configuration." The CVE-2026-97229 fix was reported through HackerOne; the researcher found the second door after the first was shut. Assume others are looking in the same place.

The patch is 24 fixes, not one

The October 12 releases close 24 security issues — 1 critical, 5 high, 14 medium, 4 low. A few of the highs are worth naming because they shape the upgrade priority beyond the 10.0:

• CVE-2026-92883 — stored cross-site scripting in syntax highlighting, CVSS 8.7.
• CVE-2026-16301 — improper authorization in the downstream pipeline creation service, CVSS 8.5.
• CVE-2026-14814 — permissive regular expression in repository file access, CVSS 8.2.
• CVE-2026-96893 — improper neutralization of input used for LLM prompting in the GitLab Duo Agent Platform (EE only), CVSS 7.3 — a prompt-injection class bug, a reminder that the AI assistant bolted onto the SCM is now part of its attack surface.

None of these changes the answer, which is upgrade now. They do mean that if you are staging the rollout, you are closing an authorization bypass and an XSS at the same time, not only the RCE.

Remediation

CERT-EU's guidance in advisory 2026-016 is blunt and correct: upgrade self-managed CE/EE instances as soon as possible, starting with the internet-facing ones. The runbook, in order:

1. Am I affected? Check the running version from the Admin Area, from /help, or on the box with sudo gitlab-rake gitlab:env:info (Omnibus) or cat /opt/gitlab/version-manifest.txt. Anything on 19.2.x below 19.2.8, 19.3.x below 19.3.4, or 19.4.x below 19.4.2 is vulnerable. GitLab.com and GitLab Dedicated are already handled.
2. Patch — exact fixed versions. Upgrade to 19.4.2, 19.3.4, or 19.2.8 depending on your branch. Note the known issue GitLab flagged: 19.3.4 has a bug affecting merge-request pages when the Ona integration is enabled, with a fix expected in 19.3.5 — plan for it if that integration is on.
3. Can't patch this hour? Reduce exposure. GitLab published no workaround for CVE-2026-97229 — the fix is the upgrade. Until it lands, pull internet-facing instances behind a VPN or allowlist, and treat the window as hostile rather than assuming the absence of a public exploit buys you time.
4. Hunt for compromise. GitLab has not published indicators for this CVE, so hunt behaviorally, not by signature: unexpected CI/CD job executions, pipeline runs tied to configurations nobody authored, new or unknown runner registrations, and outbound connections from the GitLab host or its runners to unfamiliar destinations. Map the review to MITRE ATT&CK T1190 (Exploit Public-Facing Application), T1195 (Supply Chain Compromise), and T1552.007 / T1552.001 (credentials in CI/CD and in files) — the last two because an RCE here exposes every secret the runners hold.
5. Eradicate and verify. After patching, rotate what the server could have leaked while exposed: CI/CD variables and tokens, runner registration tokens, deploy keys, registry and cloud credentials, and any personal/project access tokens with broad scope. Then confirm the fix holds — not by re-reading the version string, but by re-testing the specific path that was reachable.

Validating the fix, not the version number

The uncomfortable truth in this disclosure is that a version string is a claim, not a measurement. The September patch moved the regex-compiler bug from unauthenticated to... still exploitable, just authenticated — and three weeks later the unauthenticated variant surfaced. Reading 19.4.2 off an admin page tells you a package was installed. It does not tell you whether an anonymous request can still reach the CI/CD parser on your configuration, whether a runner was already touched during the exposure window, or whether a rotated token actually invalidated the old one.

That gap is where an autonomous AI red team earns its place. Zero Hunt runs a 10-agent swarm that fingerprints the exact GitLab product and version, then — because no public PoC exists for CVE-2026-97229 and recycling one is not an option — a sealed coding agent generates a per-target proof-of-concept against that build, iterating in an ephemeral container until it either demonstrably reaches code execution or demonstrably cannot. It runs black-box by default, the way an unauthenticated attacker hits the login-free path; it runs on-premise on private models, so the source and secrets of the system under test never leave your appliance; and every action that matters waits on a human-in-the-loop gate before it touches a live SCM. The finding is a reproduced exploit filed with the campaign and signed at write time — not a CVSS number copied into a ticket.

Patching a repeat-offender component is a sequencing problem as much as a speed one, and that is where Zero Hunt's AI Remediation Advisor takes over: it ranks the fleet by real exploitability — internet-facing instances first, then the ones a compromised runner could reach — gives the exact fixed release per branch with rollout and rollback notes, pairs it with the credential-rotation list an RCE makes mandatory, and re-verifies with the same proof that demonstrated the issue. For teams whose SCM sits under NIS2, DORA or SOC 2 scope, that reproduced-and-signed evidence is also what turns "we upgraded" into something an auditor can check. If your pipeline for finding bugs like this is still an annual engagement, our note on automated penetration testing covers why the cadence has to match the disclosure cadence — and our earlier coverage of the GitLab commits-API file read shows this is not the platform's first high-severity month.

What is not known yet

As of first publication: no CVE record is live in NVD for CVE-2026-97229 (reserved, awaiting enrichment), it is not on the CISA KEV catalog (version 2026.10.08), and neither GitLab nor CERT-EU has reported exploitation in the wild or a public proof-of-concept. The reporter's HackerOne write-up has not been disclosed. We will update this post as the NVD entry, any KEV addition, or exploitation reporting lands.