Vulnerabilities · Application Security
GitLab fixes critical flaw that could let attackers run code on servers
GitLab has patched a critical vulnerability that could let unauthenticated attackers execute code on its servers, along with several other high-severity bugs. Users running self-managed GitLab should update immediately.
Ross GrantUpdated 3 min read
The short version
GitLab has fixed a serious security problem that could let attackers run their own code on GitLab servers, even if they do not have an account. This flaw affects certain versions of both the free and paid GitLab products. If you run your own GitLab server, you should update it right away. The company also fixed several other security issues at the same time.
What happened?
GitLab has patched a critical vulnerability (CVE-2026-97229) that could let unauthenticated attackers execute code on its servers. The flaw affects both Community and Enterprise Editions. Five other high-severity bugs were also fixed. Administrators of self-managed GitLab installations are urged to update immediately. The information comes from secondary sources and has not yet been confirmed by GitLab.
What GitLab Patched
GitLab has released updates to fix a critical vulnerability, tracked as CVE-2026-97229, that could allow attackers to run code on its servers without needing to log in. The flaw affects both the Community Edition (CE) and Enterprise Edition (EE) of GitLab, specifically versions 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. The company also patched five other high-severity bugs, some of which impact pipeline security and AI agent instructions.
The patches were released on Monday, according to CSO Online (opens in a new tab) and Security Affairs (opens in a new tab). GitLab.com and GitLab Dedicated customers are already protected, but administrators of self-managed GitLab installations are urged to upgrade as soon as possible.
Details of the Critical Flaw
The main vulnerability, CVE-2026-97229, is described as an integer overflow issue in GitLab’s CI/CD (Continuous Integration/Continuous Deployment) regular expression compiler. Regular expressions are patterns used to match text, often for searching or input validation. In this case, a lack of proper validation meant an attacker could supply a specially crafted regular expression in a CI/CD configuration file. If exploited, this could let an unauthenticated attacker execute code on the GitLab server.
The flaw carries the maximum CVSS score of 10.0, meaning it is considered critical due to its potential impact on confidentiality, integrity, and availability. GitLab credited researcher Johan Carlsson for reporting the issue through its bug bounty programme.
Other High-Severity Issues Fixed
Alongside the critical bug, GitLab addressed several other vulnerabilities:
- CVE-2026-16301 (CVSS 8.5): Could let users with the Developer role run CI/CD pipelines on protected branches without proper authorisation.
- CVE-2026-14814 (CVSS 8.2): Could allow attackers to manipulate cached files, causing pipelines to run malicious code and potentially leak sensitive environment variables.
- CVE-2026-81839 (CVSS 7.7): Could let authenticated users run arbitrary pipelines in a transferred project with the new group’s privileges.
- CVE-2026-96893 (CVSS 7.3): Could let authenticated users inject crafted content into AI agent instructions, possibly causing unintended commands to be executed.
Some of these issues affect only the Enterprise Edition, while others impact both CE and EE. GitLab said that unless a specific deployment type is mentioned, all types are affected.
What Administrators Should Do
GitLab has advised administrators of self-managed installations to update to the latest patched versions immediately. The company plans to make more technical details public 90 days after the release, but recommends not waiting for further information before applying the updates. The fixes also address several lower-severity bugs in features like GitLab Pages, Kubernetes proxying, GraphQL APIs, and more.
Context and Next Steps
There is currently no evidence that these vulnerabilities have been exploited in the wild, but the risk is significant due to the potential for unauthenticated code execution. As with any critical vulnerability, prompt patching is the best defence. Organisations using GitLab should review their deployment versions and update as soon as possible.
The reporting so far comes from secondary sources. There is no primary advisory from GitLab itself available at the time of writing, so details may change as more information is released.
Claimed vs confirmed
- Unconfirmed
GitLab patched a critical flaw (CVE-2026-97229) that lets unauthenticated attackers execute code on servers.
Reported by CSO Online and Security Affairs; no primary advisory from GitLab yet.
- Unconfirmed
Five other high-severity vulnerabilities were fixed in the same release.
Reported by CSO Online and Security Affairs; not yet confirmed by GitLab.
The impact
- Money
- If regulators find a company failed to patch a known critical vulnerability, fines under GDPR could reach up to €20 million or 4% of global turnover. Actual costs depend on whether the flaw is exploited.
- Reputation
- A critical flaw in a widely used tool like GitLab can damage trust, especially if exploited. Prompt patching helps limit reputational harm.
- Customers
- Organisations running self-managed GitLab are at risk. Attackers could steal code, tamper with software, or disrupt development if the flaw is exploited. Users should update their servers immediately.
Why it matters
GitLab is widely used for managing source code and automating software builds. A flaw that lets attackers run code on servers could lead to theft of sensitive data, tampering with software, or disruption of services. Organisations running self-managed GitLab are at risk if they do not update.
How does it work?
The main flaw is an integer overflow in GitLab’s CI/CD regular expression compiler. By submitting a specially crafted regular expression in a CI/CD configuration, an attacker could trigger the overflow and execute code on the server without needing to log in.
Key points
- GitLab patched a critical flaw (CVE-2026-97229) that could let attackers run code on servers.
- The vulnerability affects both Community and Enterprise Editions before specific versions.
- Five other high-severity bugs were also fixed, some affecting pipeline security and AI features.
- Administrators of self-managed GitLab should update immediately to stay protected.
- The information is based on secondary sources and may be updated when GitLab publishes an advisory.
Sources
CSO Online
Reference
Security Affairs
Reference
