Over 1,000 GitLab servers exposed to active code execution attacks

How the flaw works

Over 1,000 GitLab servers are still exposed to a critical vulnerability tracked as CVE-2026-97229. This bug allows attackers to execute code remotely (remote code execution, or RCE) on unpatched servers. The flaw is caused by an integer overflow in the CI/CD Regular Expression Compiler, which handles regular expressions in pipeline configuration files. If an attacker submits a specially crafted regular expression, they can trick the server into running their own code. This can be done without logging in (unauthenticated), making it especially dangerous for any server open to the internet. BleepingComputer↗ (opens in a new tab)

Who is affected

The vulnerable versions are GitLab Community Edition (CE) and Enterprise Edition (EE) before 19.4.2, 19.3.5, and 19.2.8. GitLab.com and GitLab Dedicated customers are already protected, but anyone running their own GitLab server must update. Shadowserver, a threat monitoring group, reported that over 1,000 internet-facing servers are still unpatched and at risk. GitLab's platform is widely used, with over 70 million registered users and more than half of Fortune 100 companies relying on it.

The response

GitLab released security patches on 12 October to fix the issue. The company urged all self-managed users to upgrade immediately. The US Cybersecurity and Infrastructure Security Agency (CISA) confirmed that attackers are exploiting the flaw and added it to its Known Exploited Vulnerabilities (KEV) catalogue. CISA ordered US federal agencies to secure their servers by the following Sunday.

Has this happened before?

This is not the first time GitLab has faced serious security flaws. In January, it fixed a bug (CVE-2026-0723) that allowed attackers to bypass two-factor authentication. In September, another maximum-severity flaw (CVE-2026-85706) in the repository commits API was patched after reports of active abuse. Last month, a similar bug (CVE-2026-110264) in the Regular Expression Compiler was also patched, but over 11,300 servers remain vulnerable to that older flaw. Since late 2021, CISA has flagged six GitLab vulnerabilities as actively exploited, with at least one linked to ransomware attacks.

What you should do

If you run a self-managed GitLab server, check your version and update to at least 19.4.2, 19.3.5, or 19.2.8. Make sure your server is not exposed to the internet unless necessary, and review your CI/CD pipeline configurations for any suspicious changes. Regular patching and monitoring are essential for any critical software exposed online.