GitLab shipped an emergency fix on 12 October 2026 for CVE-2026-97229, a CVSS 10.0 integer overflow in the CI/CD regular expression compiler. An unauthenticated attacker who can submit a crafted regular expression in a CI/CD configuration can run arbitrary code on a self-managed server.
What happened
GitLab fixed the flaw in Community Edition and Enterprise Edition 19.4.2, 19.3.5, and 19.2.8. Affected ranges are 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. GitLab.com and GitLab Dedicated are already on the patched code. Self-managed installs are not.
The same release also closed high-severity issues covering pipeline security, repository access, and AI agent instruction injection. A compromised GitLab host is a source-code, secret, and pipeline problem, not a single bug.
Who is affected
Anyone running self-managed GitLab CE or EE in the 19.2, 19.3, or 19.4 branches below the fixed builds. Internet-facing instances are the obvious target. Internal instances still matter if an attacker can reach the web UI or API.
What to do now
- Upgrade self-managed GitLab to 19.4.2, 19.3.5, or 19.2.8 immediately.
- If you cannot patch today, restrict who can edit CI/CD configuration.
- After the upgrade, rotate tokens, deploy keys, and other secrets stored in GitLab, and review logs for unusual pipeline activity.
Source: CSO Online, 13 October 2026.
Also on the blog
- Danfoss fridge controllers hijacked at 500 French stores
- Ledger LTE implant stole recovery phrases via CryptoBilis
- NetScaler CVE-2026-107406: CVSS 9.5 SAML memory overflow
- Anthropic cuts live internet from all internal Claude evaluations
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.