GITLAB has patched a critical pre-authentication vulnerability, CVE-2026-97229, which carried a CVSS score of 10.0 and could allow an unauthenticated attacker to execute arbitrary code on affected servers. The flaw sits in the CI/CD regular expression compiler, where weak validation enables an integer overflow when processing a specially crafted expression in a CI/CD configuration. This could let an attacker run arbitrary code on the server without any login. GitLab notes that the issue affects self-managed deployments, with GitLab[.]com already fixed, while GitLab Dedicated customers require no action.
Affected versions and remediation are outlined in the patch releases issued on 8 October 2026. GitLab CE/EE versions impacted are 19.1 before 19.2.8, 19.3 before 19.3.4, and 19.4 before 19.4.2. The recommended mitigation is to upgrade to 19.4.2, 19.3.4 or 19.2.8 immediately. In the meantime, administrators should prioritise internet-facing instances, review recent CI/CD configuration changes for unexpected or crafted regular expressions, and rotate CI/CD secrets if compromise is suspected.
Exploitation in the wild has not been reported in GitLab’s advisory, and no public PoC has been confirmed; the finding was disclosed by researcher joaxcar via HackerOne. GitLab’s patch notes for 19.4.2 describe the underlying regex validation fix and the mitigation steps, with full issue details expected 90 days after the release.