GitLab patches a critical flaw that needs no login
The flaw, CVE-2026-97229, scores a maximum 10.0 and affects self-managed versions 19.2 through 19.4; patched releases are out.
GitLab released patch versions on Oct. 12, 2026 that fix CVE-2026-97229, a flaw that could let someone with no account run code on the server by using a deliberately altered regular expression in a CI/CD file, the system that automates testing and deployment, according to GitLab's official advisory.
The company rates it critical, with a 10.0 on the CVSS scale, the highest possible. The bug is an integer overflow (CWE-190) inside the compiler that interprets those expressions, caused by insufficient validation. It affects self-managed GitLab Community Edition and Enterprise Edition, and the fix ships in three versions.
| Branch | Affected | Fixed |
|---|---|---|
| 19.2 | Earlier than 19.2.8 | 19.2.8 |
| 19.3 | Earlier than 19.3.4 | 19.3.4 |
| 19.4 | Earlier than 19.4.2 | 19.4.2 |
GitLab.com already runs the fixed version, and GitLab Dedicated customers do not need to do anything. For those who run their own GitLab, including companies and developers in Mexico, the company calls for upgrading immediately, according to BleepingComputer. Those servers often hold source code and credentials.
A researcher using the alias "joaxcar" reported the flaw through the HackerOne bug bounty program. Neither GitLab nor BleepingComputer reports active exploitation, and the advisory lists no mitigation other than upgrading. The same release fixes 24 vulnerabilities in total, five more rated high severity.
GitLab says the technical details of the flaw will be made public 90 days after the release, around Jan. 10, 2027.
