More than 1,000 internet-facing GitLab servers remain unpatched against GitLab CVE-2026-97229, a maximum-severity, pre-authentication remote code execution flaw that CISA says attackers are exploiting. For Cyprus and EU firms running self-managed GitLab, a vulnerable instance holds the pipeline secrets and deploy keys that reach production.
Key takeaways
- CVE-2026-97229 is a pre-authentication RCE in GitLab's CI/CD regex compiler, fixed in CE/EE 19.4.2, 19.3.5 and 19.2.8 on 12 October 2026.
- CISA added it to KEV on 30 October; Shadowserver sees over 1,000 vulnerable instances, plus 11,300+ unpatched against CVE-2026-110264.
- Self-managed hosts exposed and unpatched after 12 October need a compromise review, not just an upgrade.
What is GitLab CVE-2026-97229, and who is exposed?
CVE-2026-97229 is an integer overflow in GitLab’s CI/CD Regular Expression Compiler, which parses regular expressions in pipeline configuration. GitLab says an unauthenticated user can run arbitrary code on the server through a crafted expression.
Only self-managed Community Edition and Enterprise Edition installations need action. No CVSS score or indicators of compromise have been published, so treat every unpatched, reachable instance as exploitable.
Code execution on the server reaches every project, stored CI/CD variable and runner registration token; masked and protected variables do not stop an attacker on the host.
Which versions fix it, and how fast did attackers move?
Upgrade to CE or EE 19.4.2, 19.3.5 or 19.2.8, released on 12 October 2026, or any later release.
CISA added the flaw to its Known Exploited Vulnerabilities catalog on Friday, 30 October, 18 days after the fix shipped, and gave US federal agencies until that Sunday. CISA has not said when exploitation began, so if your instance was reachable and unpatched at any point after 12 October, treat that whole period as in scope for review.
How many GitLab servers are still vulnerable?
In a Sunday post, the Shadowserver Foundation said it tracks more than 1,000 instances vulnerable to CVE-2026-97229, out of roughly 39,000 GitLab instances it sees daily (about 2.6%). For CVE-2026-110264, a separate maximum-severity RCE in the same regex compiler patched weeks earlier, the count is over 11,300, about 29%. An instance that has missed a month of updates is likely vulnerable to both.
CISA also flagged September’s maximum-severity commits API bug, CVE-2026-85706, as exploited after watchTowr reported scanning. Since November 2021, it has listed six GitLab flaws in KEV, one used in ransomware attacks.
What should a Cyprus or EU team do this week?
- Inventory CE and EE servers, including staging and acquired systems, and check which are internet-reachable.
- If you cannot upgrade today, restrict the web interface to a VPN or IP allowlist.
- Confirm the build is 19.4.2, 19.3.5, 19.2.8 or later, and verify the CVE-2026-110264 fix too.
- If the host was exposed and unpatched after 12 October, snapshot the disk, preserve GitLab, proxy and authentication logs, and hunt for unexpected child processes, persistence, odd outbound connections, edited pipeline files and unexplained jobs, including on runner hosts. Without public IOCs, a clean malware scan proves little.
- Upgrading does not evict an intruder. On confirmed compromise, rotate from a clean machine: CI/CD variables, personal, project and deploy tokens, runner credentials, registry and cloud keys.
Practitioner’s note: self-hosted GitLab on a forgotten subdomain is a common high-value find in our external network penetration testing work, and its CI variables can hold cloud administrator keys. An assumed breach assessment starting from the GitLab server shows what an attacker could reach.
Under NIS2, a significant incident triggers a 24-hour early warning, a 72-hour notification and a one-month final report; DORA entities must classify the event against the regulation’s criteria. Record the upgrade date and evidence now.
FAQ
Is GitLab.com affected by CVE-2026-97229?
No. GitLab.com runs the patched version, and GitLab Dedicated customers need no action.
Does the CISA KEV deadline apply to Cyprus companies?
No, it binds US federal agencies only, but it confirms active exploitation, which should drive NIS2, DORA or CySEC risk decisions.
Does upgrading GitLab remove an attacker already inside?
No. It does not remove persistence or revoke stolen secrets.
Need evidence that your development infrastructure holds up for auditors as well as attackers? Our NIS2 penetration testing covers internet-facing tooling like GitLab and the secrets behind it.