The US Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that attackers are actively exploiting a maximum-severity vulnerability in GitLab, tracked as CVE-2026-97229. The flaw, which was patched earlier this month, could allow unauthenticated remote attackers to run arbitrary code via a maliciously crafted regular expression in CI/CD configuration files. CISA has added the vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog and ordered federal agencies to secure their servers by Sunday.
GitLab addressed the issue in versions 19.4.2, 19.3.5, and 19.2.8, urging administrators to patch immediately. The company has also released threat detections to support customers with self-managed instances after detecting exploitation attempts.
"GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation," the company said.
GitLab's DevSecOps platform is used by over 50% of Fortune 100 companies and has more than 70 million registered users worldwide. Internet threat watchdog Shadowserver tracks nearly 2,800 Internet-exposed GitLab Community Edition instances, though it does not indicate how many have been secured against attacks.
While CISA's directive applies to federal agencies under Binding Operational Directive 26-04, the agency encouraged all security teams to prioritize patching. This vulnerability is the latest in a series of security issues GitLab has addressed since the start of the year, including a maximum-severity flaw in the repository commits API that CISA also added to its exploited vulnerabilities list.
Analysis
Why This Matters
- The vulnerability affects a widely used development platform, potentially compromising sensitive code and data for organizations.
- Active exploitation means unpatched GitLab instances are at immediate risk of compromise.
- CISA's directive highlights the severity and urgency for both government and private sector entities.
Background
GitLab is a DevSecOps platform used by over 50% of Fortune 100 companies and more than 70 million users. Since November 2021, CISA has tagged six GitLab vulnerabilities as exploited in the wild. This flaw, CVE-2026-97229, stems from an integer overflow in the Regular Expression Compiler and was patched earlier this month.
What to Watch
- Whether the majority of exposed instances are patched by the CISA deadline.
- Potential for additional vulnerabilities in GitLab's Regular Expression Compiler.
- Increased scanning activity for unpatched GitLab servers.
Checked
11 claims in this story checked against 1 source: 11 supported.
Show each claim
- SupportedCISA confirmed active exploitation of a maximum-severity GitLab flaw.BleepingComputer: “On Thursday, the US Cybersecurity and Infrastructure Security Agency (CISA) confirmed active exploitation and added CVE-2026-97229 to its Known Exploited Vulnerabilities (KEV) Catalog.”
- SupportedFederal agencies were ordered to secure their servers by Sunday under a CISA directive.BleepingComputer: “CISA also ordered federal agencies to secure their servers by Sunday, as mandated by Binding Operational Directive (BOD) 26-04.”
- SupportedThe flaw is tracked as CVE-2026-97229.BleepingComputer: “Tracked as CVE-2026-97229 , this critical security flaw”
- SupportedThe flaw was patched earlier this month.BleepingComputer: “Attackers have started exploiting a maximum-severity GitLab vulnerability patched earlier this month”
- SupportedThe flaw could let unauthenticated remote attackers run arbitrary code via a maliciously crafted regular expression in a CI/CD configuration.BleepingComputer: “CVE-2026-97229 stems from an integer overflow weakness and could let remote attackers run arbitrary code on targeted instances via a maliciously crafted regular expression in a CI/CD configuration, due to insufficient expression validation.”
- SupportedCISA added the vulnerability to its Known Exploited Vulnerabilities Catalog.BleepingComputer: “CISA confirmed active exploitation and added CVE-2026-97229 to its Known Exploited Vulnerabilities (KEV) Catalog .”
- SupportedGitLab addressed the issue in versions 19.4.2, 19.3.5 and 19.2.8.BleepingComputer: “GitLab addressed the security issue in GitLab Community Edition (CE) and Enterprise Edition (EE) versions 19.4.2, 19.3.5, and 19.2.8”
- SupportedGitLab released threat detections for customers with self-managed instances after detecting exploitation attempts.BleepingComputer: “The company has also released threat detections to support customers with self-managed instances after detecting exploitation attempts.”
- SupportedGitLab said: “GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation,”BleepingComputer: ““GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation,” it said .”
- SupportedShadowserver tracks nearly 2,800 internet-exposed GitLab Community Edition instances and does not say how many have been secured.BleepingComputer: “Internet threat watchdog Shadowserver tracks nearly 2,800 Internet-exposed GitLab Community Edition instances , but it doesn't say how many have already been secured against attacks.”
- SupportedCISA’s Binding Operational Directive 26-04 applies only to federal agencies.BleepingComputer: “Although BOD 26-04 targets only federal agencies”
