Attackers now exploit critical GitLab flaw, CISA says
The flaw has a maximum CVSS score of 10, and an attack on Alpine Linux's GitLab server failed on October 20 and 21.
31 Oct 2026 0 reads Compiled with AI
A flaw in GitLab's CI/CD regular-expression compiler lets attackers run arbitrary code on the server. The integer-overflow bug, logged as CVE-2026-97229, is triggered by a specially crafted regex in a pipeline configuration. Security researcher 'joaxcar' found the flaw and reported it through GitLab's HackerOne bug bounty program. GitLab patched it in Community Edition and Enterprise Edition versions 19.4.2, 19.3.5 and 19.2.8, and urged administrators to apply the update immediately.
CISA adds GitLab to known‑exploited list
CISA confirmed the flaw is being actively exploited and added CVE-2026-97229 to its Known Exploited Vulnerabilities catalog. Under Binding Operational Directive 26-04, federal agencies have until Sunday to patch it. CISA also encouraged private-sector security teams to prioritise patching. In the same catalog update, CISA added a Cisco Secure Firewall vulnerability, CVE-2026-76418, which could cause a denial-of-service condition.
Alpine Linux reported that an attacker targeted its GitLab instance on October 20 and 21 using the CVE-2026-97229 exploit. The attack failed, but Alpine rebuilt the instance and reset all passwords. It also noted automated login attempts using passwords leaked in other breaches. The attacker downloaded the GitLab container image, which suggests the exploit was tuned to Alpine's build. The bug sits in Ruby's Onigmo regex engine, so anyone running their own Ruby also needs Ruby 3.3.13, 3.4.12, 4.0.9 or later, Alpine Linux says.
Earlier this year GitLab fixed other serious flaws. In January it patched a high-severity two-factor authentication bypass, CVE-2026-0723. Earlier this month it fixed another maximum-severity regex compiler flaw, CVE-2026-110264. GitLab's DevSecOps platform is used by over half of Fortune 100 companies and has more than 70 million registered users worldwide.
Shadowserver tracks nearly 2,800 internet-exposed GitLab Community Edition instances, but does not say how many have been secured. GitLab has released threat detections to help self-managed customers spot exploitation attempts.