GitLab Security Update: Patch the CVSS 10.0 RCE (2026)

This GitLab security update is not a routine patch. On October 12, 2026, GitLab shipped an emergency patch release for CVE-2026-97229, an integer overflow in the CI/CD regular expression compiler rated CVSS 10.0 — the highest possible score — that can let an unauthenticated attacker run arbitrary code on your GitLab server. If you run a self-managed GitLab instance, read this today and upgrade today. The patches are versions 19.4.2, 19.3.5, and 19.2.8, and a public proof of concept is already circulating.

You might be tired of emergency patch posts — this is the third GitLab security release we have covered this year — but this one is different: it is the third regex-engine flaw in a single month, and history shows that maximum-severity GitLab flaws go from announcement to active exploitation in days.

Table of Contents

What the GitLab security update fixes

The headline flaw is CVE-2026-97229, and GitLab’s own advisory describes it plainly: under certain conditions, an unauthenticated user could execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, caused by insufficient regular expression validation. Here is what that means in practice.

The bug, in plain English

GitLab’s CI/CD pipeline processing includes a regular expression compiler — the component that parses and evaluates the regexes that appear in pipeline configuration files. A researcher reporting under the handle joaxcar (via GitLab’s HackerOne bug bounty programme) found that a crafted regular expression could slip past GitLab’s initial validation and then trigger an integer overflow (CWE-190) deep in the regex compiler’s program-size calculation.

Rapid7, which independently reproduced the full exploit chain, explains the mechanism: the crafted regex initially compiles into a compact US-ASCII representation that passes GitLab’s validation checks. When it is then evaluated against a specially formed but valid UTF-8 repository path, Ruby’s Onigmo regex engine recompiles it for the new encoding — after those checks have already completed. The integer overflow in the compiler then generates invalid regex instructions, breaking control-flow integrity and allowing attacker-controlled Onigmo VM operations to run an operating system command as the GitLab git user.

One more detail matters: Rapid7 found that the attacker first needs a way to plant the malicious CI/CD configuration in a repository — for example by committing a crafted .gitlab-ci.yml and a UTF-8 repository path to a branch in a public project. On instances where new users can self-register and create projects, that constraint vanishes entirely. That is a very common configuration for small self-hosted instances.

What GitLab fixed in the same release

The October 12 release addressed 24 vulnerabilities in total across Community Edition (CE) and Enterprise Edition (EE). The other notable ones:

CVE-2026-92883 (CVSS 8.7) — cross-site scripting via a specially crafted repository, letting an authenticated user run arbitrary JavaScript in other users’ browsers.
CVE-2026-16301 (CVSS 8.5) — improper authorisation in the downstream pipeline creation service, letting an authenticated user with the Developer role run CI/CD pipelines on protected branches.
CVE-2026-7767 (medium) — an open redirect in GitLab’s Kubernetes proxy that could send sensitive authentication tokens to an unintended server. Notably, this was also reported by joaxcar.

Three high-severity bugs are addressed alongside these, so even if the headline CVE somehow did not apply to you, this is a release worth taking.

Are you affected? Check in 30 seconds

The answer depends entirely on your version. GitLab fixed the flaw in 19.4.2, 19.3.5, and 19.2.8, released October 12, 2026. Everything on the 19.2, 19.3, and 19.4 branches below those patches is vulnerable:

Your version branch	Affected versions	Upgrade to
19.2.x	19.2.0 through 19.2.7	19.2.8
19.3.x	19.3.0 through 19.3.4	19.3.5
19.4.x	19.4.0 through 19.4.1	19.4.2

Who does not need to act: GitLab.com users (already patched) and GitLab Dedicated customers (no action needed, per GitLab). Everyone running a self-managed instance — Omnibus package, Docker, Kubernetes/Helm, or source install — must upgrade.

To find your running version right now:

# Omnibus / Linux package installs
head -1 /opt/gitlab/version-manifest.txt

# Or check which pinned versions are available to you
sudo apt-cache madison gitlab-ee

You can also find the version in the web UI: click your avatar in the top-left, then Help — the version is listed there. If you are on 19.2.7 or below, 19.3.4 or below, or 19.4.1 or below, you are vulnerable.

Version gotcha: some early advisories listed 19.3.4 as the fixed version. GitLab’s current guidance is 19.3.5, because 19.3.4 introduced a separate bug affecting merge request pages when the Ona integration is enabled. Always go to 19.3.5 on the 19.3 branch.

Upgrade to a patched version: step by step

Rapid7 recommends upgrading affected self-managed instances outside of the normal patch cycle — that means now, not at the next maintenance window. The good news: this is a patch-bump upgrade (19.4.1 to 19.4.2), which is the safest kind of GitLab upgrade there is.

Step 1: Take a backup first

Never skip this. On an Omnibus install:

sudo gitlab-backup create

This creates a timestamped backup in /var/opt/gitlab/backups. Make sure you have enough free disk space for a full copy of your data before you start.

Step 2: Install the pinned patch version

Do not just run a blanket upgrade — pin the exact fixed version so nothing unexpected rides along. GitLab’s own upgrade docs use this syntax:

# Ubuntu / Debian, GitLab EE (replace ee with ce for Community Edition)
sudo apt update
sudo apt install gitlab-ee=19.4.2-ee.0

# RHEL / AlmaLinux 8/9
sudo dnf install gitlab-ee-19.4.2-ee.0.el8

# Check which pinned versions your package manager can see first
sudo apt-cache madison gitlab-ee

Adjust the package version to your branch: 19.2.8 or 19.3.5 instead of 19.4.2, keeping the -ee.0 (or -ce.0) suffix. The install automatically runs gitlab-ctl reconfigure and applies the pending database migrations.

Step 3: Docker installs

If you run GitLab in Docker, official image tags follow the pattern <major>.<minor>.<patch>-ce.<build>, so the patched image for the 19.4 branch is:

# Back up from inside the container first
docker exec -t <container-name> gitlab-backup create

# Then point your image at the patched release and recreate
docker pull gitlab/gitlab-ce:19.4.2-ce.0
docker compose up -d

If you use a plain docker run setup, stop and remove the old container, then recreate it with the new image tag and the same volumes and flags. Your data lives in the volumes, so it survives the container swap.

Step 4: Verify you are patched

head -1 /opt/gitlab/version-manifest.txt
sudo gitlab-ctl status

Confirm the running version shows 19.4.2, 19.3.5, or 19.2.8, and that all services are up. Then run a quick smoke test: push a commit, let a pipeline run, and log in to the web UI.

Two things to plan for: GitLab notes this patch release includes database migrations, so single-node instances will see downtime while migrations run. Multi-node deployments can upgrade without downtime using GitLab’s documented zero-downtime procedure — but do read the upgrade path guidance for your specific topology before you start.

Can’t patch tonight? Reduce exposure now

Rapid7 is explicit that these controls only reduce exposure to the demonstrated attack path — they do not fix the vulnerable regex compiler, so treat them as a stopgap, not a substitute:

Restrict anonymous access to public projects. If the world cannot see your public projects, an anonymous attacker cannot easily use them as the delivery vehicle.
Stop untrusted users from creating or writing to public projects. Require admin approval for new projects, or move to an invite-only model temporarily.
Disable or restrict self-registration. Admin Area > Settings > General > Sign-up restrictions. If anyone can create an account and a project, anyone can plant the malicious configuration file.

Then schedule the actual upgrade for the earliest moment you can take a short maintenance window. Do not let the stopgaps become the plan.

What to check if you were running a vulnerable version

As of October 13, 2026, there is no confirmed in-the-wild exploitation of CVE-2026-97229, and it has not been added to CISA’s Known Exploited Vulnerabilities catalogue. But a public proof of concept landed on GitHub the day after the patch (Rapid7’s analysis was published October 13), and attackers are fast when a maximum-severity GitLab flaw ships with working exploit code.

If your instance was internet-facing and unpatched for any window since October 12, do a compromise check before you declare victory:

Preserve logs first. Keep application logs, authentication records, and CI/CD audit events before you rotate or clear anything.
Look for unexpected pipeline definitions. Check for .gitlab-ci.yml files or pipeline changes in public projects that nobody on your team recognises.
Review protected branches and runners. Look for newly registered or reconfigured runners, changes to protected-branch settings, and any unfamiliar deploy tokens.
Rotate what matters. If you find anything suspicious, treat CI/CD variables, deploy tokens, and runner registration tokens as potentially exposed — a GitLab server compromise can quickly become a supply-chain compromise.

Why this one is urgent: the pattern

This is the third GitLab regular-expression-engine flaw in about a month. On September 23, GitLab patched two CVSS 9.9 RCE bugs in the same component (CVE-2026-89078, a double-free, and CVE-2026-93577, an integer overflow) — both required authentication. CVE-2026-97229 is the escalation: same component family, now unauthenticated, now the maximum 10.0. Attackers have clearly learned exactly which part of GitLab to keep probing.

And the September 10 precedent is sobering: CVE-2026-85706, a CVSS 10.0 path traversal in the commits API, went from disclosure to active exploitation fast enough that CISA added it to the KEV catalogue within days, with security firms observing live probing. Maximum-severity GitLab flaws do not stay theoretical.

The exposure numbers underline it. Censys scanned the internet and found 25,766 hosts still running vulnerable versions, tied to 79,224 web properties — roughly 31% of all detected GitLab hosts unpatched. The largest concentrations are in Germany (6,469 hosts), Russia (4,173), and the United States (2,927). Every unpatched, publicly reachable instance is now a known target with a public exploit.

Emergency-patch fatigue is real, but this is the one category of update you should never defer: an unauthenticated RCE on the box that holds your source code, your CI/CD secrets, and your deployment credentials. The upgrade itself is a patch bump and takes minutes. Patch first, then read the advisory.

GitLab Security Update (Oct 2026): Patch the CVSS 10.0 RCE Right Now