GitLab CVE-2026-97229: a CVSS 10 flaw is under active exploitation and CISA added it to KEV

On 29 October 2026 the US agency CISA added CVE-2026-97229, a CVSS 10.0 flaw in GitLab, to its catalog of exploited vulnerabilities. It sits in CI/CD handling and can lead to code execution on the server. Patches are available.

On 29 October 2026 CISA added CVE-2026-97229, a vulnerability in GitLab CE and EE, to its Known Exploited Vulnerabilities catalog. It is an integer overflow in regular expression handling for CI/CD and carries the maximum CVSS score of 10.0. Successful exploitation can allow code execution on the server running GitLab.

The listing rests on real exploitation. The Alpine Linux project disclosed an incident in which an unknown attacker tried, unsuccessfully, to exploit its GitLab instance on 20 and 21 October, crashing worker processes eight times and downloading the application container image. Sources differ on when and by whom exploitation was first confirmed, so we leave that detail out.

According to Rapid7, an attacker first needs to place a malicious CI/CD configuration in a repository. On instances where new users can register themselves and create projects, that precondition disappears. Open sign-up is what turns this bug into an urgent problem even for smaller companies that run GitLab themselves.

GitLab fixed the issue in versions 19.2.8, 19.3.5 and 19.4.2. Branches 19.1 and earlier, and 19.5, are not listed as affected in the sources we checked. Do not confuse it with CVE-2026-110264, a separate regular expression issue GitLab disclosed later in October. The advice is simple: check your version, update, and review who has an account on the instance.