CVE-2026-97229 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-10-13

Added to CISA KEV: 2026-10-29 16 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

⚠️ CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity before patching
EMERGENCY PATCH: Upgrade GitLab CE/EE to versions 19.2.8, 19.3.5, or 19.4.2 immediately — treat this as an emergency change. If running any version in the 19.2.x, 19.3.x, or 19.4.x series below the patched versions, the instance is critically vulnerable to unauthenticated RCE.
INCIDENT RESPONSE: Before patching, preserve system logs. After patching, conduct immediate forensic review of GitLab application logs, web server access logs, and system audit logs (auditd/syslog) for signs of exploitation — look for unexpected process spawning from the GitLab application user, unusual outbound connections, new user accounts, or modifications to repository contents.
THREAT HUNTING: Given confirmed in-the-wild exploitation, perform proactive threat hunting. Check for unauthorized SSH keys added to server, new GitLab admin accounts, modifications to CI/CD pipelines or .gitlab-ci.yml files, unexpected cron jobs, and web shells in GitLab's application directories.
TEMPORARY MITIGATION (if patching is delayed): Consider placing GitLab behind a WAF with rules targeting malicious regex patterns in CI/CD API payloads. Review and restrict anonymous access to CI/CD configuration endpoints. Consider temporarily requiring authentication for all CI/CD pipeline interactions.
CREDENTIAL ROTATION: After patching and forensic review, rotate all sensitive credentials stored in or accessible via GitLab: deployment tokens, personal access tokens, SSH keys, CI/CD secret variables, and any secrets in repository files.
NETWORK CONTROLS: If GitLab does not need to be publicly accessible, restrict access to known IP ranges or place behind VPN/zero-trust access. This reduces the attack surface to authenticated network paths.
SUPPLY CHAIN REVIEW: If exploitation cannot be ruled out, audit all CI/CD pipeline outputs (build artifacts, container images, deployment packages) produced during the exposure window for signs of malicious code injection.
MONITORING: Deploy alerting for anomalous behavior on the GitLab server — unexpected child processes of the GitLab Rails/Puma processes, unusual network connections, file system changes outside expected paths. Consider deploying runtime application self-protection (RASP) or EDR on the GitLab host.
PATCH PRIORITY: P0/CRITICAL — this is a maximum-severity, pre-auth RCE with confirmed active exploitation and public PoC. Treat with same urgency as a known ransomware delivery vector.

🔍 Web Intelligence (Kagi · 2026-10-29)

Summary

CVE-2026-97229 is a critical-severity (CVSS 10.0) integer overflow vulnerability located within the CI/CD Regular Expression Compiler of GitLab Community Edition (CE) and Enterprise Edition (EE). The flaw allows an unauthenticated, remote attacker to execute arbitrary code on the underlying GitLab server by submitting a specially crafted, malicious regular expression within a CI/CD configuration file. Because this component is frequently exposed to user-controlled input, the vulnerability poses a severe threat to the integrity and confidentiality of any compromised GitLab instance.

Exploitation

Active Exploitation: There is documented evidence of active exploitation attempts in the wild, including a targeted attack on the Alpine Linux GitLab instance occurring shortly after the vulnerability disclosure .
Threat Actors: While specific advanced persistent threat (APT) groups have not been publicly named, the nature of the attacks indicates interest from actors capable of exploiting high-severity remote code execution flaws.
Exploit Availability: Proof-of-concept (PoC) code and research details regarding the exploitation of the regex compiler vulnerability are circulating in the security community .
Attack Prerequisites: The attack is network-exploitable and does not require authentication or user interaction on the part of the victim; it relies on the processing of untrusted input via the affected CI/CD regex engine .

Affected Products & Patches

Affected Versions: GitLab CE/EE versions 19.2 before 19.2.8 and 19.3 before 19.3.5 are affected .
Patch Availability: GitLab has released patches in versions 19.2.8 and 19.3.5 to remediate the vulnerability. Administrators are strongly urged to update to these versions or newer immediately .
Mitigations: In environments where patching is delayed, administrators should audit existing CI/CD configuration files to remove or replace complex, potentially unsafe regular expressions with simpler, pre-validated patterns .

Impact

Access & Capability: Successful exploitation grants the attacker the ability to execute arbitrary code on the GitLab server with the privileges of the application process, effectively leading to a full system compromise.
Business Risk: For internet-facing deployments, this vulnerability allows external attackers to gain complete control over the CI/CD pipeline, potentially leading to unauthorized data exfiltration, the compromise of source code repositories, the injection of malicious code into build artifacts (supply chain attack), and further lateral movement within the organization's network.