Vulnerabilities · Application Security
Critical GitLab flaw now exploited: CISA urges urgent patching
Attackers are exploiting a critical GitLab vulnerability that lets them run code on unpatched servers. CISA has ordered US agencies to patch by Sunday and urges all admins to update now.
Ross Grant2 min read
The short version
A serious security flaw in GitLab lets attackers run code on servers without logging in. The US government says this bug is now being used in real attacks. GitLab has released updates to fix the problem, and experts say all admins should patch their servers right away. If you use GitLab, check your version and update as soon as possible.
By the numbers
- 2,800Internet-exposed GitLab Community Edition serversBleepingComputer
- 70 millionGitLab registered users worldwideBleepingComputer
- 50%Fortune 100 companies using GitLabBleepingComputer
What happened?
Attackers are now exploiting a critical GitLab vulnerability (CVE-2026-97229) that lets them run code on unpatched servers. CISA has confirmed the flaw is being used in real attacks and has ordered US federal agencies to patch by Sunday. GitLab has released fixes and detection rules, and urges all admins to update immediately. Nearly 2,800 GitLab Community Edition servers are exposed online, but it is unclear how many are patched.
How the flaw works
A critical vulnerability in GitLab, tracked as CVE-2026-97229, is now being actively exploited. The flaw is in the CI/CD Regular Expression Compiler, which processes regular expressions in pipeline configuration files. An attacker can exploit an integer overflow weakness by submitting a specially crafted regular expression. This allows them to run any code they want on the targeted GitLab server, even if they are not logged in. This type of attack is called remote code execution (RCE).
The vulnerability was discovered by a security researcher known as 'joaxcar'. GitLab has said the problem was due to insufficient validation of regular expressions in CI/CD configurations. The company fixed the issue in versions 19.4.2, 19.3.5, and 19.2.8 of both its Community Edition (CE) and Enterprise Edition (EE) software. BleepingComputer (opens in a new tab)
The response
The US Cybersecurity and Infrastructure Security Agency (CISA) confirmed that attackers are exploiting this flaw and added it to its Known Exploited Vulnerabilities (KEV) catalogue. CISA has ordered US federal agencies to patch their GitLab servers by Sunday, under Binding Operational Directive 26-04. While this order applies to federal agencies, CISA is urging all organisations, including private companies, to patch as soon as possible.
GitLab has released threat detection rules to help customers with self-managed servers spot exploitation attempts. The company is also urging administrators to update their servers immediately.
Who is affected
GitLab is widely used, with over 70 million registered users and more than half of Fortune 100 companies relying on its DevSecOps platform. According to threat monitoring group Shadowserver, there are nearly 2,800 GitLab Community Edition instances exposed to the internet. It is not clear how many of these have been patched.
Has this happened before?
This is not the first time GitLab has faced serious security issues. Since the start of the year, the company has patched several high and critical severity flaws, including a two-factor authentication bypass (CVE-2026-0723) and other remote code execution bugs. CISA has flagged six GitLab vulnerabilities as exploited in the wild since November 2021, showing that attackers regularly target unpatched GitLab servers.
What you should do
If you run a GitLab server, check your version and update to 19.4.2, 19.3.5, or 19.2.8 as soon as possible. Review your logs for signs of suspicious activity, especially related to CI/CD pipeline configurations. Apply any threat detection rules provided by GitLab. Even if you are not a US federal agency, patching quickly is essential to protect your systems from active attacks.
Why it matters
This flaw lets attackers take control of GitLab servers, which are used by many large companies and organisations. Exploited servers could be used to steal code, plant malware, or attack other systems. Fast patching is needed to prevent major breaches.
Key points
- Attackers are exploiting a critical GitLab vulnerability (CVE-2026-97229).
- The flaw allows remote code execution via CI/CD pipeline configurations.
- CISA has ordered US agencies to patch by Sunday and urges all to update.
- GitLab has released fixes and detection rules for self-managed servers.
- Over 2,800 GitLab CE servers are exposed online, patch status unknown.
Sources
BleepingComputer
Reference