Zero Radar
← feed
CriticalSecurity incidentCVE-2026-97229updated 1 Nov 2026, 15:14 UTC

GitLab server can be taken over via a crafted CI/CD regex

Someone with no login could send a specially crafted pattern in a GitLab pipeline setting and run their own commands on the GitLab server. Attackers are already trying this, so unpatched servers need updating now.

Exploited (Hacker News, CISA KEV)Official, 8 sources
SeverityCriticalCVSS 10 of 10
Being exploited?YesConfirmed by Hacker News, CISA KEV, NVD, The Hacker News, BleepingComputer · 29 Oct 2026
What to doCheck exposureUpdate your self-managed GitLab to 19.2.8, 19.3.5, or 19.4.2 (matching your release line) or later.
How sure is this?Official, 8 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker crafts patternMalicious regex placed in CI/CD configuration
  2. 2Request reaches GitLabNo login needed under certain conditions
  3. 3Regex not validatedInsufficient validation lets crafted input through
  4. 4Code runs on serverAttacker's code executes on the GitLab host
  5. ResultAttacker runs code on GitLab server

What happened

GitLab Community Edition and Enterprise Edition have insufficient regular expression validation in CI/CD configuration, allowing an unauthenticated user to execute arbitrary code on the server under certain conditions.

Why it is dangerous: A successful attack gives the attacker control of the GitLab server, which typically holds source code, secrets, and CI/CD pipelines. Any organization running affected self-managed GitLab is at risk.

Are you affected?

You are affected if you run self-managed GitLab CE or EE 19.2 before 19.2.8, 19.3 before 19.3.5, or 19.4 before 19.4.2, with the conditions GitLab describes for exposure.

GitLab CE/EE 19.2 before 19.2.8; 19.3 before 19.3.5; 19.4 before 19.4.2 (per GitHub Advisory, 'all versions from 19.2' up to these fixes)

What to do

  1. Update GitLab CE/EE to 19.2.8, 19.3.5, 19.4.2, or later
  2. If the instance was exposed and unpatched, check logs and CI/CD configurations for signs of compromise
  3. Review internet exposure of your GitLab server and restrict access where possible

Timeline

  1. 13 Oct 2026, 02:17 UTC
    Publicly disclosed
  2. 28 Oct 2026, 23:45 UTC
    Reported by Hacker News · Hacker News
  3. 29 Oct 2026, 00:19 UTC
    Picked up by Zero Radar
  4. 29 Oct 2026, 00:28 UTC
    GitHub Advisory reported on it · GitHub Advisory
  5. 29 Oct 2026, 00:28 UTC
    Severity raised to critical
  6. 29 Oct 2026, 00:28 UTC
    Fix: GitLab CE/EE 19.2.8, 19.3.5, 19.4.2 or later
  7. 29 Oct 2026, 11:07 UTC
    The Hacker News reported on it · The Hacker News
  8. 29 Oct 2026, 12:00 UTC
    Reported by CISA · CISA
  9. 29 Oct 2026, 19:15 UTC
    CISA KEV reported on it · CISA KEV
  10. 29 Oct 2026, 19:15 UTC
    Confirmed by CISA KEV
  11. 29 Oct 2026, 20:25 UTC
    NVD reported on it · NVD
  12. 29 Oct 2026, 21:06 UTC
    CISA reported on it · CISA
  13. 30 Oct 2026, 07:27 UTC
    Reported by The Hacker News · The Hacker News
  14. 30 Oct 2026, 09:41 UTC
    SecurityWeek reported on it · SecurityWeek
  15. 30 Oct 2026, 13:02 UTC
    BleepingComputer reported on it · BleepingComputer
  16. 1 Nov 2026, 15:11 UTC
    Reported by BleepingComputer · BleepingComputer

Sources 11 reports, oldest first

Official vendor, government CERT or advisory database

Security press established security newsrooms

Community discussion sites, treat with care

Technical details

ID
CVE-2026-97229 · GHSA-9hj5-r43h-h3xg · ZR-af6ffe74
CVSS
10 / 10
EPSS
18% chance of exploitation within 30 days
Disclosed
13 Oct 2026, 02:17 UTC
On Zero Radar
29 Oct 2026, 00:19 UTC (16 days after disclosure)
Last change
1 Nov 2026, 15:14 UTC

The plain-language parts and the attack diagram were written by an AI model (claude-haiku-5-5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

GitLab server can be taken over via a crafted CI/CD regex · Zero Radar