GitLab admins urged to patch critical RCE flaw (CVE-2026-97229)
Aucun autre média suivi par Zonactu ne rapporte encore cette info.
GitLab is urging users of self-managed instances to patch a critical vulnerability (CVE-2026-97229) in its CI/CD Regular Expression Compiler that could allow remote attackers to execute arbitrary code on GitLab servers.
CVE-2026-97229 is an integer overflow vulnerability in GitLab’s CI/CD Regular Expression Compiler, and it affects both GitLab Community Edition (CE) and Enterprise Edition (EE).
GitLab has assigned the vulnerability a CVSS score of 10.0, the highest possible. According to the CVSS vector, the flaw can be exploited remotely, with low complexity, and without privileges or user interaction.
“GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation,” reads the advisory.
GitLab fixed the flaw in GitLab Community Edition (CE) and Enterprise Edition (EE) versions 19.4.2, 19.3.5 and 19.2.8, released on October 12, 2026. The vulnerability affects all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2.
The company notes that version 19.3.4 had a bug that affected merge request pages when the Ona integration was enabled, which is fixed in 19.3.5.
“These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately,” the company warned.
“GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action,” it added .
The vulnerability was reported by a researcher going by the handle joaxcar through GitLab’s HackerOne bug bounty program.
The same researcher also reported CVE-2026-7767 , a medium-severity open redirect flaw in GitLab’s Kubernetes proxy that could lead to sensitive authentication tokens being sent to an unintended server.
CVE-2026-97229 is the latest of several vulnerabilities GitLab has fixed in recent months. In August, the company released patches for CVE-2026-19478 , a critical code injection flaw that could be exploited without authentication to modify or delete public projects and user data.
