GitLab patches maximum-severity flaw in self-managed servers
An attacker with no account could have run code on a company’s own GitLab server, where its source code, build pipelines and the credentials those pipelines use are kept
- The release fixes 24 security flaws: one critical, five high, 14 medium and four low
- Flaws rated high include cross-site scripting in syntax highlighting and unauthorized pipeline runs on protected branches
- The patches include database migrations, and GitLab said single-node instances will have downtime during the upgrade
- GitLab said one patched build has a bug affecting merge request pages when the Ona integration is enabled
Exposure falls on organizations that run GitLab on their own servers or private cloud, including software companies, managed service providers and in-house development teams. The critical flaw affects every CE and EE installation on the 19.2, 19.3 and 19.4 release lines below the fixed builds, while other flaws in the release also affect older versions, and one high-rated flaw affects every version before the fixed builds. GitLab’s hosted GitLab.com service already runs the fix, and the vendor said GitLab Dedicated customers have nothing to do.
“we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately”GitLab, security release notes
GitLab released patched versions of its Community Edition (CE) and Enterprise Edition (EE) on 12 October to fix a flaw scored 10.0, the highest rating on the Common Vulnerability Scoring System (CVSS).
The flaw, CVE-2026-97229, is an integer overflow in the regular expression compiler behind GitLab’s continuous integration and delivery (CI/CD) feature, which builds, tests and deploys code automatically. GitLab said that, under certain conditions and because of insufficient validation, an unauthenticated user could have executed arbitrary code on the GitLab server by placing a specially crafted regular expression in a CI/CD configuration. A researcher using the name joaxcar reported it through GitLab’s HackerOne bug bounty program.
As BleepingComputer reported, the release comes a month after the US Cybersecurity and Infrastructure Security Agency (CISA) added another GitLab flaw, the path traversal bug CVE-2026-85706, to its Known Exploited Vulnerabilities catalog on 11 September. The catalog lists five GitLab flaws, the first added in November 2021, and CISA marks one of them as used in ransomware campaigns. GitLab’s release notes do not say the new flaw has been exploited.
Sources
- GitLab, “GitLab Critical Patch Release: 19.4.2, 19.3.4, 19.2.8”, security release, 12 October 2026. https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/
- CISA, “Known Exploited Vulnerabilities Catalog”, catalog version 2026.10.08, 8 October 2026. https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- BleepingComputer, “GitLab warns of max severity code execution vulnerability”, news article, 12 October 2026. https://www.bleepingcomputer.com/news/security/gitlab-warns-of-max-severity-rce-flaw-in-regex-compiler-engine/
