More than 1,000 GitLab servers remain exposed to actively exploited RCE flaw

More than 1,000 Internet-exposed GitLab servers remained unpatched against CVE-2026-97229 as of early November, according to Shadowserver. The critical vulnerability is an integer overflow in GitLab’s CI/CD Regular Expression Compiler and can lead to arbitrary code execution under certain conditions. GitLab released fixes for Community Edition and Enterprise Edition in versions 19.4.2, 19.3.5, and 19.2.8 on October 12, 2026. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on October 29 after exploitation was confirmed. GitLab.com and GitLab Dedicated were already patched, but self-managed operators should also review the separate CVE-2026-110264 issue and upgrade to releases that address it.

Why it matters

Self-managed GitLab installations can expose source code, CI/CD credentials, runners, tokens, and other development infrastructure if an attacker gains code execution on the server. Although GitLab rates the flaw as exploitable without authentication, independent analysis found that a demonstrated attack path requires the attacker to place malicious CI/CD content in a project first; operators should therefore investigate both unpatched systems and suspicious project or pipeline activity.

Key points

  • CVE-2026-97229 is a CVSS 10.0 integer-overflow vulnerability in GitLab’s CI/CD Regular Expression Compiler.
  • GitLab fixed the issue in CE and EE versions 19.4.2, 19.3.5, and 19.2.8, released October 12, 2026.
  • Shadowserver reported more than 1,000 Internet-exposed instances still vulnerable, while CISA listed the flaw in its KEV catalog on October 29.
  • The demonstrated exploit chain may require an attacker to add malicious CI/CD content or otherwise gain the ability to write to a project, despite GitLab’s unauthenticated-exploitation rating.
  • GitLab.com and GitLab Dedicated were patched; operators should also address the separate related regex-compiler flaw CVE-2026-110264, fixed in later releases.

Based on reporting by The original announcement and BleepingComputer.