“We strongly recommend that all self‑managed GitLab installations be upgraded to one of these versions immediately,” GitLab wrote on October 12 — advice that remains urgent because more than 1,000 Internet‑exposed GitLab servers are still unpatched against a maximum‑severity remote code execution flaw actively exploited in the wild.
CVE‑2026‑97229 and the Regular Expression Compiler
The vulnerability, tracked as CVE‑2026‑97229, arises from an integer overflow in GitLab’s CI/CD Regular Expression Compiler, the component that parses and evaluates regular expressions inside pipeline configuration files. According to GitLab’s advisory, the flaw “could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.”
GitLab’s patch release and who must act
On October 12 GitLab published security patches to address the issue for self‑managed installations. The fixed releases are GitLab Community Edition (CE) and Enterprise Edition (EE) versions 19.4.2, 19.3.5, and 19.2.8. GitLab said GitLab.com is already running the patched version and that “GitLab Dedicated customers do not need to take action.” The company characterized the releases as containing “important bug and security fixes” and explicitly urged immediate upgrade for self‑managed deployments.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleCISA’s KEV listing and federal directive
The U.S. Cybersecurity and Infrastructure Security Agency confirmed that attackers had begun exploiting CVE‑2026‑97229 and added the flaw to its Known Exploited Vulnerabilities (KEV) Catalog. CISA paired the listing with a directive ordering federal agencies to secure vulnerable GitLab servers by Sunday. The agency noted this is the latest in a string of GitLab flaws it has tracked as actively exploited: since November 2021, CISA has added six GitLab vulnerabilities to the KEV Catalog, and one of those has been used in ransomware attacks.
Shadowserver telemetry: scale of exposure
Despite the patch and CISA’s warning, volunteer threat monitoring group Shadowserver reported over the weekend that it is tracking “over 1000 GitLab instances vulnerable to CVE‑2026‑97229 (on @CISACyber KEV).” Shadowserver also said it is tracking more than 11,300 instances vulnerable to a separate maximum‑severity Regular Expression Compiler bug (CVE‑2026‑110264), which GitLab patched last month; Shadowserver’s observations come from “around 39K GitLab instances we see daily.”
What this means for federal agencies, GitLab self‑managed customers, and security teams
- Federal agencies: CISA’s KEV listing carries an explicit timetable — agencies were ordered to secure affected servers by Sunday — making remediation a required, time‑bound action rather than optional guidance.
- GitLab self‑managed customers: Organizations running their own GitLab instances must upgrade to one of the patched releases (19.4.2, 19.3.5, or 19.2.8) immediately, per GitLab’s advisory; customers using GitLab.com or GitLab Dedicated were told they already have or do not need the update.
- Security teams and incident responders: Shadowserver’s telemetry that thousands of instances remain exposed — and that multiple high‑severity GitLab flaws have been actively abused this year — underscores that unattended self‑hosted instances present an ongoing attack surface and that scanning and patch verification are essential.
This episode is the latest in an intensifying pattern: GitLab addressed a high‑severity credential‑theft vulnerability (CVE‑2026‑0723) in January, CISA flagged CVE‑2026‑85706 after reports of scanning, and a separate maximum‑severity Regular Expression Compiler bug (CVE‑2026‑110264) was patched only last month. Taken together, the facts in public advisories and telemetry highlight both the attractiveness of GitLab instances to attackers and the operational gap between patch publication and universal deployment.
GitLab emphasizes the platform’s wide use — “over 70 million registered users” and adoption by “more than 50% of Fortune 100 companies worldwide” — a scale that helps explain why unpatched instances present a lucrative target for threat actors. Shadowserver’s counts make clear that publication of a patch is only the first step; the remaining question is whether the thousands of exposed, unpatched instances can be updated before attackers widen exploitation.
Original reporting: Over 1,000 GitLab servers vulnerable to ongoing RCE attacks — BleepingComputer
