GitLab Critical Vulnerability Scores a Perfect 10.0
GitLab Patches a Maximum-Severity Flaw
GitLab has fixed a critical vulnerability that, under certain conditions, lets attackers run arbitrary code on a server. They need no password and no user interaction.
The flaw received the maximum score of 10.0 on CVSS. Developers released urgent fixes and urged owners of self-managed servers to update.
How CVE-2026-97229 Works
CVE-2026-97229 resides in the regular expression compiler that GitLab uses for CI/CD configurations. Insufficient checks on a specially crafted expression can trigger an integer overflow. In turn, that overflow can lead to the execution of foreign code.
So far, GitLab has not disclosed the exact conditions for a successful attack.
Why the Risk Is So High
Under CVSS 3.1, the attack works over the network and has low complexity. Moreover, it needs neither an account nor any action by the victim. A successful exploit can harm the confidentiality, integrity, and availability of the system.
GitLab often stores source code and runs build pipelines. Therefore, a hacked server can affect an entire development infrastructure.
Affected Versions and Fixes
The bug affects GitLab Community Edition and Enterprise Edition from the 19.2 branch onward. Fixes arrived on October 12, 2026, in versions 19.2.8, 19.3.5, and 19.4.2.
Developers recommend installing the right patch on self-managed servers at once. GitLab.com is already updated. Meanwhile, GitLab Dedicated customers need take no extra action.
Discovery and Disclosure
A researcher known as joaxcar found the flaw and reported it through the HackerOne bug bounty program. GitLab has not reported any confirmed attacks that use CVE-2026-97229.
The company is withholding full technical details for now. It plans to make the related tracker issues public 90 days after the patches.
Other Serious Bugs in the Same Release
The same October patch release fixed several other dangerous flaws:
- CVE-2026-92883 (CVSS 8.7): An authenticated user can inject JavaScript through a crafted repository, so that code runs in another person’s browser.
- CVE-2026-16301 (CVSS 8.5): Under certain conditions, a developer can run CI/CD pipelines on protected branches without permission.
- CVE-2026-14814 (CVSS 8.2): An attacker can poison the repository file cache. Another user’s pipeline may then run the swapped content and potentially expose protected environment variables.
- CVE-2026-96893: Malicious instructions can be injected into the context of the GitLab Duo AI agent.
In addition, GitLab fixed access control bugs, secret leaks through GitLab Pages logs, and token handling issues.
What Administrators Should Do
Administrators should update internet-facing servers first. A previous GitLab flaw with a maximum score of 10 came under real-world attack in September.
However, there is no confirmed exploitation of the new flaw yet.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
