Attackers are exploiting a maximum-severity GitLab vulnerability that was patched earlier this month, according to the U.S. Cybersecurity and Infrastructure Security Agency (CISA). Tracked as CVE-2026-97229, the flaw could allow unauthenticated attackers to execute arbitrary code on vulnerable GitLab servers using specially crafted regular expressions in CI/CD configuration files.
Critical GitLab flaw added to CISA’s exploited vulnerabilities catalog
CVE-2026-97229 affects the CI/CD regular expression compiler, which parses, compiles and evaluates regular expressions in pipeline configuration files. The vulnerability is classified as an CWE-190 integer overflow weakness and was reported by security researchers using the HackerOne handle joashkar.
Insufficient expression validation could enable a remote attacker to execute arbitrary code on a targeted instance through a maliciously crafted regular expression in a CI/CD configuration.
“GitLab has fixed an issue where insufficient regular expression validation could, under certain conditions, allow unauthenticated users to execute arbitrary code on GitLab servers via specially crafted regular expressions in CI/CD configurations,” GitLab said.
GitLab addressed the issue in Community Edition (CE) and Enterprise Edition (EE) versions 19.4.2, 19.3.5 and 19.2.8. The company urged administrators to update their servers immediately and released threat-detection capabilities to help customers with self-managed instances identify exploitation attempts.
On Thursday, October 29, 2026, CISA added CVE-2026-97229 to its Known Exploited Vulnerabilities (KEV) Catalog. Under Binding Operational Directive (BOD) 26-04, federal agencies were ordered to secure affected servers by Sunday.
Although BOD 26-04 applies only to federal agencies, CISA encouraged private-sector security teams and other organizations to prioritize patching the vulnerability to protect their networks from continued attacks.
Thousands of GitLab instances exposed online
Internet threat-monitoring organization Shadowserver reported that approximately 2,800 GitLab Community Edition instances were exposed to the internet. It was not clear how many of those systems had already been secured against the attack.
Latest in a series of exploited GitLab vulnerabilities
CVE-2026-97229 is the latest in a series of GitLab security issues addressed since the beginning of the year. In January, GitLab patched a high-severity two-factor authentication bypass, CVE-2026-0723. The flaw allowed an attacker who knew a target’s account ID to bypass two-factor authentication.
Earlier this month, GitLab also fixed the maximum-severity regular expression compiler vulnerability CVE-2026-110264, which could allow a remote attacker to execute arbitrary code on a vulnerable instance.
Almost two weeks later, the company addressed another maximum-severity flaw, CVE-2026-85706, in the repository commit API. The vulnerability could be exploited to read sensitive information, including credentials, from a vulnerable server.
One day later, CISA added CVE-2026-85706 to its catalog of actively exploited vulnerabilities after cybersecurity firm watchTowr reported that attackers had begun scanning the internet for unpatched GitLab servers.
CISA’s catalog lists six GitLab vulnerabilities exploited in the wild since November 2021, including CVE-2021-22175 and CVE-2021-39935, which were added in February of this year.
GitLab says its DevSecOps platform is used by more than 50% of Fortune 100 companies and has over 70 million registered users worldwide.
The overall prevention score can hide what happens after the initial access. If an attacker uses valid credentials, your defenses drop dramatically.
The Blue Report 2026 measures defense techniques by technology across 338 million simulations run in customer production environments.
Source: www.bleepingcomputer.com