GitLab self-managed servers open to code execution without a login, now on CISA's exploited list (CVE-2026-97229)

30 October 2026Critical 10.0Being exploited

GitLab · GitLab Community Edition and Enterprise Edition (self-managed) · CVE-2026-97229

GitLab self-managed servers open to code execution without a login, now on CISA's exploited list

A flaw in how GitLab compiles regular expressions in CI/CD settings lets an unauthenticated attacker run code on the GitLab server. GitLab rates it CVSS 10.0. CISA added it to its Known Exploited Vulnerabilities list on 29 October, with a federal deadline of 1 November, and says other software using the same Ruby regular expression code may be affected.

Affected: Self-managed GitLab CE and EE from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. GitLab.com and GitLab Dedicated are already patched.
What to do: Upgrade self-managed GitLab to 19.2.8, 19.3.5 or 19.4.2 or later. GitLab lists no workaround. Because CISA lists it as exploited, review the server for signs of compromise, and check any other Ruby application that builds regular expressions from untrusted input: the Ruby project fixed the underlying problem in Ruby 4.0.9, 3.4.12 and 3.3.13.General information summarised from the vendor's advisory at the time of writing, not professional advice. Check the vendor's current advisory before acting.
Why it’s here: On CISA's KEV list, scored CVSS 10.0, and GitLab is widely used to host code and deploy websites.

GitLab self-managed servers open to code execution without a login, now on CISA's exploited list

Affected

Self-managed GitLab CE and EE from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. GitLab.com and GitLab Dedicated are already patched.

What to do

Upgrade self-managed GitLab to 19.2.8, 19.3.5 or 19.4.2 or later. GitLab lists no workaround. Because CISA lists it as exploited, review the server for signs of compromise, and check any other Ruby application that builds regular expressions from untrusted input: the Ruby project fixed the underlying problem in Ruby 4.0.9, 3.4.12 and 3.3.13.General information summarised from the vendor's advisory at the time of writing, not professional advice. Check the vendor's current advisory before acting.

Why it’s here

On CISA's KEV list, scored CVSS 10.0, and GitLab is widely used to host code and deploy websites.