GitLab CI/CD regular expression integer overflow allows unauthenticated remote code execution (CVE-2026-97229)

What happened

CVE-2026-97229 is an integer overflow/wraparound (CWE-190) in GitLab CE/EE. An unauthenticated attacker can, under certain conditions, submit a specially crafted regular expression in a CI/CD configuration. Insufficient validation of the expression can trigger the integer overflow and lead to arbitrary code execution on the GitLab server.

The CVSS v3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, giving a score of 10 (critical). This means the issue is reachable over the network without privileges or user interaction. CISA added the CVE to its KEV catalog on 29 October 2026; CISA's SSVC assessment rates exploitation as active, and ENISA EUVD records exploitation since 29 October 2026.

Who is affected

Self-managed GitLab CE/EE instances running 19.2 to before 19.2.8, 19.3 to before 19.3.5, or 19.4 to before 19.4.2 are affected. GitLab is often used for source code management and continuous integration, so the affected server may hold source code, secrets, and deployment credentials.

What to do now

1. Upgrade to the fixed release for your installed minor version: GitLab 19.2.8, GitLab 19.3.5, or GitLab 19.4.2. Do this first because the flaw is reachable without authentication and is recorded as actively exploited.
2. If you cannot patch immediately, treat any internet-facing GitLab instance as exposed and restrict network access as far as possible. No workaround is listed in the source record.
3. After patching, check all instances and CI/CD configuration changes for unexpected regular expressions or pipeline modifications, and verify that the patch has been applied consistently.

How to detect it

No specific indicators of compromise are listed in the CVE record. Until the patch is applied, monitor internet-facing GitLab instances for unexpected CI/CD configuration changes, unusual process execution on the GitLab server, and child processes or services spawned by GitLab components. Exploitation starts with a crafted CI/CD regular expression, so treat unexpected pipeline edits as suspicious.

Beyond the patch

Because this is network-reachable without credentials and is already recorded as actively exploited, an unpatched GitLab server is a high-exposure system. Virtual CISO Services can help identify exposed or unpatched instances across your estate, and Managed Detection & Response can detect the post-exploitation activity that tends to follow arbitrary code execution.