GitLab patches critical unauthenticated RCE in CE and EE versions
CERT-EU urges immediate upgrades for self-managed GitLab instances after a critical remote code execution flaw was disclosed.
Key points
- GitLab released patches on 12 October 2026 fixing 24 security issues, including a critical vulnerability.
- CVE-2026-97229 allows unauthenticated attackers to execute arbitrary code via the CI/CD regular expression compiler.
- CERT-EU strongly recommends upgrading all self-managed instances, prioritizing those facing the internet.
GitLab released security patches on 12 October 2026 for versions 19.4.2, 19.3.4, and 19.2.8 of its Community Edition and Enterprise Edition platforms. These updates address 24 distinct security issues, headlined by a critical vulnerability that enables unauthenticated remote code execution on affected servers.
At a glance
- Publisher
- CERT-EU
- CVEs
- See advisory
The primary flaw, identified as CVE-2026-97229, carries a CVSS score of 10.0. According to the European Union Agency for Cybersecurity (CERT-EU), the issue resides in the CI/CD regular expression compiler. Weak validation of regular expressions leads to an integer overflow, which a specially crafted expression in a CI/CD configuration can exploit to trigger code execution.
Context and Background
In addition to the critical remote code execution flaw, the October 2026 release resolves several other high-severity vulnerabilities. CVE-2026-92883, rated 8.7, is a cross-site scripting flaw in syntax highlighting. This defect allows an authenticated user to run arbitrary JavaScript in other users' browsers through a crafted repository.
Another significant issue, CVE-2026-16301 with a CVSS score of 8.5, involves an authorization flaw. This bug permits a developer to run pipelines on protected branches without having the necessary permissions. The release also fixes 21 further issues, including a cache poisoning bug rated 8.2 that could potentially expose protected CI/CD variables.
Who Is Affected
The vulnerabilities impact self-managed instances of GitLab CE and EE running versions prior to the patched releases. CERT-EU specifically highlights that internet-facing instances are at the highest risk due to the unauthenticated nature of the primary exploit. The advisory strongly recommends that administrators upgrade all self-managed instances to a fixed version as soon as possible.
Administrators should prioritize patching systems that are directly accessible from the public internet. The integer overflow mechanism in the regular expression compiler means that attackers do not need valid credentials to attempt exploitation, making exposure to external networks a critical risk factor for self-hosted deployments.
What should you do?
Administrators managing self-hosted GitLab environments should verify their current version against the affected list. Those running versions older than 19.4.2, 19.3.4, or 19.2.8 should schedule an immediate upgrade to the respective patched versions. Prioritizing internet-facing instances is essential to mitigate the risk of unauthenticated remote code execution.
What to do and how to stay safe: GitLab
- Verify your current GitLab CE or EE version and compare it to the patched versions 19.4.2, 19.3.4, and 19.2.8.
- Prioritize upgrading internet-facing instances to mitigate the risk of unauthenticated remote code execution.
- Review CI/CD configurations for any unusual or suspicious regular expressions that could indicate prior exploitation attempts.
- Monitor logs for signs of unauthorized pipeline executions on protected branches, which may indicate abuse of the authorization flaw.
Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for the critical GitLab vulnerability?
The critical vulnerability, CVE-2026-97229, has a CVSS score of 10.0.
Which GitLab versions are affected by these security issues?
Self-managed GitLab CE and EE instances running versions prior to 19.4.2, 19.3.4, and 19.2.8 are affected.
Does the critical vulnerability require authentication to exploit?
No, the critical vulnerability allows an unauthenticated attacker to execute arbitrary code on the server.
