# GitLab CI/CD: exploited regex compiler flaw allows code execution Canonical: https://www.oktsec.com/radar/gitlab-cve-2026-97229 Publisher: Oktsec Language: en Published: 2026-10-30T10:26:59Z Updated: 2026-10-30T10:26:59Z Record reviewed: 2026-10-30T10:26:59Z Latest evidence check: 2026-10-30T10:26:59Z Disclosed: 2026-10-12 CISA added CVE-2026-97229 to KEV on October 29: the CI/CD regex compiler flaw allows unauthenticated code execution in affected GitLab CE and EE versions. Install the latest supported branch patch and review vendor detection guidance. ## Evidence and response priority - Category: Vulnerability - Oktsec priority: Act now - Rationale: CISA lists this exact CVE as exploited. Affected self-managed GitLab releases allow unauthenticated code execution through the CI/CD regular expression compiler. - Evidence: Attacks confirmed - Verification: Vendor confirmed - Fix status: Fix available - Exposure requirement: Application or configuration dependent - Vendor: GitLab - Products: GitLab CE, GitLab EE - CVEs: CVE-2026-97229 - Vendor severity: CVSS 3.1 10 ## Technical overview An integer overflow in GitLab’s CI/CD regular expression compiler can allow a remote attacker to execute code without authentication. GitLab rates CVE-2026-97229 at CVSS 3.1 10.0. CISA added this exact vulnerability to KEV on October 29; the entry does not establish when attacks began. GitLab published the original fixes on October 12: 19.2.8, 19.3.5 and 19.4.2. These are historical minimum fixes, not a recommendation to install an older patch today. Use the latest patch for a supported branch, including corrections for subsequent vulnerabilities. GitLab says GitLab.com and GitLab Dedicated were patched. The vendor advisory provides six detection scenarios covering native regex worker crashes, hostile GraphQL CI lint expressions, oversized non-ASCII paths, guard rejections, Workhorse worker crashes and scripted client error bursts. Use their documented conditions when investigating; a crash alone does not prove exploitation. This is separate from CVE-2026-110264. Their similar descriptions do not justify transferring KEV evidence between them. Keep both vulnerabilities in the patch review and verify the version actually serving traffic. ## Recommended response Install the latest supported branch patch, verify the running version and investigate the CI/CD indicators in the vendor advisory. Do not downgrade to an older minimum fix. Relevant to: Teams operating GitLab CE or EE 19.2, 19.3 or 19.4 on their own infrastructure. ## CVE attribution - CVE-2026-97229: GitLab — GitLab CE, GitLab EE; CVSS 3.1: 10. [Source](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/97xxx/CVE-2026-97229.json) ## Affected systems and fixes ### GitLab CE / EE 19.2 Affected: 19.2 before 19.2.8 Fixed release / action: 19.2.8 — original minimum fix; use the latest supported branch patch, including later security fixes. ### GitLab CE / EE 19.3 Affected: 19.3 before 19.3.5 Fixed release / action: 19.3.5 — original minimum fix; use the latest supported branch patch, including later security fixes. ### GitLab CE / EE 19.4 Affected: 19.4 before 19.4.2 Fixed release / action: 19.4.2 — original minimum fix; use the latest supported branch patch, including later security fixes. Confirm the running version against the vendor advisory, including any distribution backports. ## CISA KEV evidence Catalog: 2026.10.29 Checked: 2026-10-30T10:27:08.428Z ### [CVE-2026-97229](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-97229) - Added: 2026-10-29 - Ransomware use: Not confirmed by CISA - Federal due date: 2026-11-01 - Federal forensic triage: Yes Action specified by CISA: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. CISA KEV inclusion establishes known exploitation of the listed CVE, not compromise of your environment. Absence does not rule out exploitation. The date added is not the first attack date. Federal deadlines and forensic triage requirements are context, not universal obligations for private organizations or businesses in Latin America. ## Supporting evidence Snapshot checked: 2026-10-27T15:30:57.206Z. These dates do not change the incident’s editorial review date. ### FIRST EPSS forecast No score returned for: CVE-2026-97229 EPSS is a prediction, not exploitation evidence or organization-specific risk. Confirmed exploitation takes precedence. A missing score is not zero. Check status: available; last successful check: 2026-10-27T15:30:57.206Z. ### Official regional advisories - [Vulnerabilidades en Productos de GitLab](https://www.cert.gov.py/vulnerabilidades-en-productos-de-gitlab-2/) — CERT-PY, Paraguay; publication 2026-10-13T14:01:49.000Z; observed 2026-10-27T15:30:57.206Z; matched by exact CVE identifier. Publisher country does not establish victim location. Original notices may repeat the same underlying advisory. ## Response checklist 1. **Inventory deployed CE and EE versions** — Identify affected 19.2, 19.3 and 19.4 instances. Verify the running version on each node rather than only the intended package or image. 2. **Install the latest supported branch patch** — The listed versions are the original October 12 fixes. Later updates fix additional vulnerabilities, including CVE-2026-110264. Follow supported upgrade paths and do not downgrade to these historical minimum versions. 3. **Use the vendor detection guidance** — Review CI lint and regular expression worker crashes, hostile regex requests, oversized non-ASCII paths and guard rejections using the six detection scenarios in the advisory. Preserve logs before maintenance; patch completion does not establish absence of compromise. 4. **Review credentials reachable from the instance** — If investigation identifies compromise, scope access to repositories, CI/CD secrets, runners and integrations before revoking or rotating affected credentials. Record findings and telemetry gaps. ## Relevance to AI environments Review repository tokens, CI/CD secrets and runner credentials accessible to a compromised instance. This is an exposure review, not evidence that an AI agent caused exploitation. ## Sources - [GitLab October 12 security patch release and detection guidance](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/) — GitLab; Vendor notice; checked 2026-10-30T10:26:59Z - [GitLab CNA record: CVE-2026-97229](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/97xxx/CVE-2026-97229.json) — GitLab / CVE Program; Vendor notice; checked 2026-10-30T10:26:59Z - [CISA KEV: CVE-2026-97229 added October 29](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json) — CISA; Government advisory; checked 2026-10-30T10:26:59Z ## Editorial record - 2026-10-30T10:26:59Z: Added the October 29 KEV inclusion for CVE-2026-97229 and the original October 12 branch fixes. Kept this evidence separate from CVE-2026-110264 and directed operators to later supported patches. ## Related incidents - [GitLab issues an emergency code execution fix](https://www.oktsec.com/radar/gitlab-cve-2026-110264) ## Use this advisory in Radar Use the Advisory view to understand the issue and its evidence, Affected systems to compare versions, and Response plan to record applicability, an owner and action progress. Plans are saved only in the current browser and can be downloaded for sharing; they are not a shared team account or an automated scan. Completing a plan does not validate remediation. Talk to Oktsec opens a technical consultation with the advisory and selected service preserved. Scope, fees and access are agreed before any assessment. [Open advisory](https://www.oktsec.com/radar/gitlab-cve-2026-97229) · [Build a response plan](https://www.oktsec.com/radar/gitlab-cve-2026-97229#review-workspace) - [Patch verification consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=gitlab-cve-2026-97229&service=patch_verification) - [Exposure check consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=gitlab-cve-2026-97229&service=exposure_check) ## Scope and corrections Radar is a selected editorial collection, not a complete vulnerability database or a scan of your environment. Priorities are Oktsec analysis. Source confirmation and checklist completion do not establish whether your systems are compromised or secure. [Sources and methodology](https://www.oktsec.com/radar/about). Report corrections with supporting sources to info@oktsec.com. Do not send secrets or private incident data.