GitLab CE/EE Unauthenticated Remote Code Execution (RCE) Advisory (CVE-2026-97229)
Executive & SecOps Summary
SECOPS ASSESSMENTGitLab CE/EE versions 19.2 (< 19.2.8), 19.3 (< 19.3.5), and 19.4 (< 19.4.2)
Unauthenticated attackers can execute arbitrary code on the GitLab server via crafted CI/CD configurations, leading to full system compromise
Immediate upgrade to patched versions 19.2.8, 19.3.5, or 19.4.2 is mandatory
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND- Apply Security Patches: Update your GitLab instance immediately using the official repositories.
# For Omnibus GitLab (Ubuntu)
sudo apt-get update && sudo apt-get install gitlab-ee=19.4.2-ee.0
sudo gitlab-ctl reconfigure- Network Filtering: Restrict access to the GitLab web interface and API to trusted IP ranges until the patch is applied.
- WAF Implementation: Deploy Web Application Firewall (WAF) rules to detect and block overly complex or recursive regex patterns in CI/CD linting requests.
Scan Your Repositories for Transitive Vulnerable Dependencies in 30 Seconds
Automatically detect vulnerable packages across npm, PyPI, Maven, and Go, and open automated fix Pull Requests without breaking your build.
Technical Root Cause & Exploitation Mechanics
This vulnerability stems from an Integer Overflow (CWE-190) within the regular expression validation logic of GitLab's CI/CD pipeline processing. By submitting a specially crafted CI/CD configuration, an unauthenticated user can trigger memory corruption in the underlying regex engine. The inclusion of this CVE in the CISA KEV catalog and an EPSS score of 0.94 indicates high exploitation activity in the wild. The vulnerability allows for a complete bypass of authentication mechanisms to achieve Remote Code Execution (RCE) with the privileges of the GitLab service user.
Official Vendor Advisories & References
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.