More than 1,000 GitLab servers accessible from the Internet remain unpatched against a critical vulnerability that is already being used in remote code execution attacks. Shadowserver reported that it continues to monitor these instances, even though GitLab released security updates on October 12.
The flaw, identified as CVE-2026-97229, affects the CI/CD regular expression compiler. An integer overflow could allow a specially crafted expression in a pipeline configuration to execute code on the affected server.
A regular expression crafted to exploit the flaw
GitLab described the issue as insufficient validation of regular expressions. Under certain conditions, an unauthenticated user could execute arbitrary code through an expression entered in a CI/CD configuration. The company released fixes for GitLab Community Edition and Enterprise Edition in versions 19.4.2, 19.3.5, and 19.2.8.
“GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation,”
— GitLab
Rapid7 assigned the vulnerability a CVSS score of 10.0 and reproduced code execution in an unpatched official GitLab CE image. In its tests, the attack chain required the ability to add a malicious .gitlab-ci.yml file to a public project. Rapid7 notes that, on instances that allow user registration and project creation, a regular account can meet this requirement.
This detail describes the route Rapid7 tested; GitLab said that, under certain conditions, the flaw could be exploited without authentication. The distinction matters when assessing exposure, but it does not change the recommendation to update affected self-managed installations.
Alpine Linux detected an attempt that did not execute
The exploitation had already reached specific targets. SecurityWeek reported that Alpine Linux detected an attack against its GitLab instance on October 20 and 21. The attacker used a newly registered account to submit crafted CI/CD configurations, which caused the worker process to crash.
Alpine said the attempt did not succeed in executing code, although it could not completely rule out that the server had been compromised. In four of the crashes, the attacker reportedly advanced partway through the exploit before failing. The attacker also downloaded Alpine’s GitLab container image, which, according to the distribution, suggested they were adapting the exploit to that build. Alpine rebuilt the instance and verified that the aports repository, packages, and October 21 releases had not been altered.
The case also revealed a particular consideration for installations using their own Ruby build: Alpine explained that updating GitLab was not enough in its environment because the vulnerability also affects Ruby’s Onigmo regular expression engine. For those running GitLab with a version of Ruby compiled from source or included in a custom image, Alpine said Ruby must also be updated to a fixed version.
Which versions need to be updated
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-97229 to its Known Exploited Vulnerabilities catalog. Rapid7 dates the addition to October 29; BleepingComputer reports that CISA ordered federal agencies to secure their servers by Sunday.
Self-managed GitLab CE and EE installations should update to the fixed version in their respective branch: 19.2.8, 19.3.5, or 19.4.2. GitLab.com is already running a patched version, and GitLab Dedicated customers do not need to take action, according to the company.
Until the update is complete, Rapid7 recommends restricting anonymous access to public projects and preventing untrusted users from creating or modifying public projects. The firm warns that these measures reduce exposure to the delivery route it reproduced, but do not fix the vulnerable compiler. In addition to the more than 1,000 servers affected by this flaw, Shadowserver counts more than 11,300 instances vulnerable to another regular expression compiler flaw, CVE-2026-110264.
Sources: BleepingComputer, Rapid7, Censys, SecurityWeek
