Organizations running vulnerable GitLab servers face active attacks against CVE-2026-97229, a maximum-severity flaw that can let attackers run code without signing in under certain conditions. The US Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its exploited-flaws catalog on October 29, putting remediation on the immediate agenda for administrators.
Both GitLab Community Edition (CE) and Enterprise Edition (EE) are affected. BleepingComputer reported on October 30 that GitLab patched the issue earlier that month in releases 19.4.2, 19.3.5 and 19.2.8. The company also issued threat detections for customers operating self-managed instances after observing exploitation attempts.
The attack reaches the server through a specially crafted regular expression—a pattern used to match text—in a CI/CD configuration, which defines automated software build and deployment work. The weakness lies in GitLab’s Regular Expression Compiler and involves an integer overflow, where a calculation exceeds the software’s numeric range. BleepingComputer quoted GitLab as saying inadequate validation of these expressions could, under certain conditions, allow an unauthenticated user to execute code on the server.
The potential exposure extends beyond a handful of installations: BleepingComputer cited Shadowserver’s count of nearly 2,800 internet-exposed GitLab CE instances, although their patch status was unspecified.
CISA’s Binding Operational Directive 26-04 requires US Federal Civilian Executive Branch agencies to prioritize qualifying exploited vulnerabilities on publicly exposed systems and establishes expectations for checking for compromise before patching. BleepingComputer reported a Sunday remediation deadline for this flaw. Those requirements apply to those federal agencies; CISA also encourages other organizations to prioritize remediation.
Administrators of affected GitLab servers should follow the company’s call to patch immediately, installing 19.4.2, 19.3.5 or 19.2.8 for their respective release train. Customers with self-managed instances can also use GitLab’s released threat detections to support their investigation of exploitation attempts.
