Vulnerabilities · Application Security
Critical GitLab flaw could let attackers take over servers: update now, says CERT-EU
A critical vulnerability in GitLab CE and EE could let attackers run code on servers. CERT-EU urges all users to update to the latest version immediately.
Ross Grant2 min read
The short version
A serious flaw in GitLab software could let attackers take control of servers that have not been updated. The problem affects organisations running their own GitLab CE or EE servers, not the cloud service. CERT-EU says everyone should update their servers right away. Attackers do not need a password to exploit this flaw.
What happened?
On 12 October 2026, GitLab released updates for its Community and Enterprise Editions, fixing 24 security issues. CERT-EU highlighted a critical flaw (CVE-2026-97229) that could let unauthenticated attackers run code on affected servers. CERT-EU urges all self-managed GitLab users to update immediately.
What is the GitLab vulnerability?
On 12 October 2026, GitLab released updates for its Community Edition (CE) and Enterprise Edition (EE) software. These updates fix 24 security issues, including a critical vulnerability that could let an unauthenticated attacker (someone who does not need to log in) run any code they want on a GitLab server. This is called remote code execution. The flaw is tracked as CVE-2026-97229 and has the highest possible severity score (CVSS 10.0), according to CERT-EU (opens in a new tab).
How does the attack work?
The vulnerability is in the CI/CD regular expression compiler. CI/CD stands for Continuous Integration and Continuous Deployment, tools that help automate software development. The flaw comes from weak validation of regular expressions (patterns used to match text). If an attacker submits a specially crafted regular expression in a CI/CD configuration, it can cause an integer overflow. This lets the attacker run their own code on the server, without needing a valid account.
Who is affected?
The issue affects self-managed GitLab CE and EE instances. These are servers that organisations run themselves, not the cloud-hosted GitLab.com service. CERT-EU strongly recommends that all organisations upgrade their GitLab servers to the fixed versions as soon as possible. They say to start with any servers that are exposed to the internet, as these are most at risk.
Other vulnerabilities fixed
The same update also fixes other serious issues:
- CVE-2026-16301 (CVSS 8.5): an authorisation flaw that could let a developer run pipelines on protected branches without permission.
- A cache poisoning bug (CVSS 8.2) that could expose protected CI/CD variables.
- 21 further issues, details not specified in the advisory.
What should you do?
If you run a self-managed GitLab CE or EE server, update to version 19.4.2, 19.3.4 or 19.2.8 immediately. Prioritise any servers that are accessible from the internet. Delaying the update could leave your systems open to attack. If you use GitLab.com (the cloud service), this issue does not affect you.
What is not yet clear
At the time of writing, only CERT-EU has reported this vulnerability. There are no reports yet of attackers exploiting it in the wild. It is not clear if any organisations have already been affected.
Claimed vs confirmed
- Confirmed
A critical GitLab CE/EE vulnerability allows unauthenticated remote code execution.
CERT-EU reports that CVE-2026-97229 allows an unauthenticated attacker to execute code on the server.
- Unconfirmed
The vulnerability is being actively exploited.
No evidence or reports of active exploitation have been published.
The impact
- Money
- If exploited, the vulnerability could lead to data breaches or business disruption. Under GDPR, fines for serious breaches can reach up to €20 million or 4% of annual global turnover.
- Reputation
- A successful attack could damage trust in an organisation's software development process and lead to public scrutiny.
- Customers
- Organisations running self-managed GitLab servers are at risk. Users should update their software immediately to protect their systems.
Why it matters
Organisations running their own GitLab servers are at risk of a full server takeover if they do not update. This could lead to data theft, service disruption, or further attacks inside a company. The flaw is easy to exploit and affects a widely used development tool.
How does it work?
The vulnerability is in the CI/CD regular expression compiler. Weak validation allows a specially crafted regular expression in a CI/CD configuration to cause an integer overflow, which can then let an attacker execute arbitrary code on the server without logging in.
Key points
- A critical GitLab flaw allows unauthenticated remote code execution.
- CERT-EU urges immediate updates for all self-managed GitLab CE/EE servers.
- The vulnerability is in the CI/CD regular expression compiler.
- Other serious issues were fixed in the same update.
- No known exploitation has been reported yet.
Sources
CERT-EU
Government
