Skip to content
GitLab Issues Emergency Patch for Critical RCE Vulnerability

GitLab Issues Emergency Patch for Critical RCE Vulnerability

First seen 12 Oct 2026, 15:34 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 13, 2026 at 11:31 UTC
  • •CVE-2026-97229 is a critical RCE vulnerability with a CVSS score of 10.0.
  • •The flaw allows unauthenticated attackers to execute arbitrary code via crafted regex in CI/CD configurations.
  • •Self-managed GitLab installations must upgrade to versions 19.4.2, 19.3.4, or 19.2.8 immediately.

GitLab has released emergency patches for a critical remote code execution vulnerability, CVE-2026-97229, affecting its Community and Enterprise Editions. This flaw, stemming from an integer overflow in the CI/CD regular expression compiler, allows unauthenticated attackers to execute arbitrary code via specially crafted regular expressions in pipeline configurations. The vulnerability carries a CVSS score of 10.0 and affects all versions from 19.2 prior to 19.2.8, 19.3 prior to 19.3.4, and 19.4 prior to 19.4.2. GitLab has confirmed that GitLab.com is already patched, while self-managed installations must upgrade immediately. The flaw was reported by a researcher known as 'joaxcar' through GitLab's HackerOne bug bounty program. This incident highlights a growing trend of critical vulnerabilities in GitLab's software, with multiple serious flaws disclosed in 2026.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-01-22
CVE-2026-0723 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-07-27
CVE-2026-42016 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-08-12
CVE-2026-42018 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-08-28
CVE-2026-82329 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-09-11
CVE-2026-85706 added to CISA KEV
CISA flagged the vulnerability as actively exploited in the wild and added it to the Known Exploited Vulnerabilities catalog.
CISA KEV
2026-09-23
CVE-2026-89078 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-02
CVE-2026-90970 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-08
GitLab releases patches for CVE-2026-97229
Emergency updates were issued for GitLab CE and EE to address the critical RCE vulnerability.
Cyberkendra
2026-10-12
GitLab warns of critical vulnerability
GitLab issued an emergency advisory urging users to patch the critical RCE flaw immediately.
Bleepingcomputer
2026-10-13
CVE-2026-97229 published
The vulnerability was officially published with a CVSS score of 10.0, confirming its critical nature.
Thehackernews

More articles in this cluster (24)

Following this threat?

Track Goldman Sachs and CVE-2026-0723 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (24)

1 / 3

Common questions

Which versions are affected?
All GitLab versions from 19.2 before 19.2.8, 19.3 before 19.3.4, and 19.4 before 19.4.2 are affected.
Is this vulnerability being exploited?
Yes, the vulnerability is confirmed to be actively exploited in the wild.
What should I do to protect my systems?
Immediately upgrade to the patched versions: 19.4.2, 19.3.4, or 19.2.8.