GitLab warned self-managed customers on 12 October 2026 to patch CVE-2026-97229 immediately. It is an integer overflow in the CI/CD regular-expression compiler, scored CVSS 10.0, and it can let an unauthenticated attacker run code on the server.
What happened
The bug sits in the component that parses regular expressions in pipeline configuration. GitLab says insufficient validation of those expressions can, under certain conditions, turn a crafted regex into arbitrary code execution. No login is required.
Researcher joaxcar reported it through GitLab's HackerOne program. GitLab.com is already on the patched release. GitLab Dedicated customers do not need to act. There was no public report of in-the-wild exploitation as of 12 October.
The warning lands weeks after CVE-2026-85706, another maximum-severity GitLab flaw that CISA added to the Known Exploited Vulnerabilities catalog in September after unauthenticated file reads were observed.
Who is affected
Self-managed GitLab Community Edition and Enterprise Edition in these ranges are affected. GitLab.com and GitLab Dedicated are not.
- 19.2 before 19.2.8
- 19.3 before 19.3.4
- 19.4 before 19.4.2
What to do now
Upgrade self-managed GitLab to 19.4.2, 19.3.4, or 19.2.8 today, and do not wait for exploit reports.
Confirm the running version from the Admin Area or /help before you assume a minor release is safe. After the upgrade, review CI/CD configuration changes from unknown users and unexpected pipeline jobs on internet-reachable instances.
Source: BleepingComputer, 12 October 2026. GitLab warns of max severity code execution vulnerability.
Also on the blog
- CVE-2026-102255: SonicWall SMA1000 CVSS 10.0 SSRF under attack
- Ledger finds unauthorized implant in CryptoBilis-sold wallets
- Palo Alto CVE-2026-0257 Still Used for Ransomware VPN Access
- Bricksforge CVE-2026-85097 CVSS 10 WordPress RCE Exploited
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.