GitLab Patches CVSS 10.0 Flaw That Lets Attackers Run Code Without Logging In
GitLab patched CVE-2026-97229, a CVSS 10.0 flaw that could let an unauthenticated user run code on self-managed GitLab servers through a crafted regex in CI/CD config. Fixed in 19.4.2, 19.3.5, and 19.2.8. Upgrade now.
GitLab has shipped an emergency patch release for a maximum-severity flaw in GitLab Community Edition and Enterprise Edition. Tracked as CVE-2026-97229 and scored a perfect 10.0 on CVSS, the bug could let an unauthenticated user run arbitrary code on a self-managed GitLab server.
According to GitLab's advisory, the problem sits in the CI/CD regular expression compiler. Under certain conditions, a specially crafted regular expression in a CI/CD configuration could slip past insufficient validation and lead to code execution on the server. The CVE record classifies it as an integer overflow (CWE-190). The flaw was reported through GitLab's HackerOne bug bounty program by the researcher known as joaxcar.
The vulnerable releases are 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. GitLab released the fixed versions, 19.4.2, 19.3.5, and 19.2.8, on October 12, 2026. GitLab.com is already running the patched code, and GitLab Dedicated customers do not need to do anything.
The same release closes a long list of other issues. Three of the high-severity ones stand out, as The Hacker News points out. CVE-2026-92883 (CVSS 8.7) is a cross-site scripting bug in syntax highlighting that could let a logged-in user run JavaScript in other users' browser sessions through a crafted repository. CVE-2026-16301 (CVSS 8.5) could let a user with the Developer role run CI/CD pipelines on protected branches through the downstream pipeline creation service. CVE-2026-14814 (CVSS 8.2) could let a user poison cached responses for raw repository files, which could make targeted users' pipelines run crafted content and potentially expose protected environment variables.
The timing matters. Last month, another maximum-severity GitLab flaw, CVE-2026-85706, saw in-the-wild probing within hours of public disclosure, The Hacker News reports. There is no public word of exploitation for CVE-2026-97229 yet, but anyone running GitLab on their own servers should assume attackers are already reading the advisory too. Help Net Security has a good summary of the fix as well.
If you run self-managed GitLab, upgrade to the patch release for your minor version today: 19.4.2 if you are on 19.4, 19.3.5 if you are on 19.3, and 19.2.8 if you are on 19.2. GitLab notes that this release includes database migrations, so a single-node instance will be down while they run. Multi-node setups can follow the zero-downtime upgrade process. If you were holding off on 19.3.4 because of its merge request page bug with the Ona integration enabled, that is fixed in 19.3.5, so there is no reason to wait.
If you are on an older minor version that GitLab no longer patches, this is a good moment to plan the jump to a supported release, since several of the other fixes in this batch reach back much further than 19.2.
