Max-Severity GitLab Flaw CVE-2026-97229 Under Active Attack, CISA Says

Attackers are already exploiting GitLab CVE-2026-97229, a maximum-severity flaw, and the U.S. government has put a short clock on it. On Oct. 29, 2026, CISA added the bug to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active attacks. Federal agencies have about three days to patch, a deadline that lands this weekend.

The flaw carries a CVSS score of 10.0, the top of the scale, and it lets an unauthenticated attacker run code on the server. Any organization that self-hosts GitLab Community Edition or Enterprise Edition should treat this as an emergency rather than a routine update.

What GitLab CVE-2026-97229 lets attackers do

The bug is an integer overflow in GitLab's regular-expression handling for CI/CD, the pipeline system that runs build and test jobs. According to The Hacker News, a specially crafted configuration file can trigger it. No login is required, which is what pushed the severity to the maximum.

SecurityWeek quoted GitLab's October 12 advisory as saying the bug “could have allowed an unauthenticated user to execute arbitrary code on the GitLab server.” That language matches what researchers have since demonstrated.

Rapid7 published a proof-of-concept and said it reproduced code execution on an unpatched official GitLab CE image. An attacker still has to commit a malicious CI/CD file to a branch in a public project, Rapid7 said. Instances that allow self-registration remove that requirement, which makes them the easiest to reach.

Which GitLab versions fix CVE-2026-97229

GitLab released patches for Community Edition and Enterprise Edition on Oct. 12, 2026, according to Help Net Security. The fixed releases are:

• GitLab CE and EE 19.4.2
• GitLab CE and EE 19.3.5
• GitLab CE and EE 19.2.8

Admins should move to one of those releases or a later version. Cybersecuritynews reported that a separate, later GitLab regex bug, CVE-2026-110264, is not fixed by the CVE-2026-97229 update, so do not treat the two as one issue. The sources reviewed did not confirm whether CVE-2026-110264 is being exploited.

Why the Ruby patch matters for self-built servers

The most unusual part of this story came from Alpine Linux. According to Alpine's incident notice, attackers tried the exploit against its own GitLab instance on Oct. 20 and 21. The attack failed, but the crash and 502 errors forced Alpine to rebuild the server from scratch, a process it completed on Oct. 28.

Alpine also found that the GitLab upgrade alone may not close the hole. The vulnerable regex engine is written in Ruby, and GitLab's bundled packages carry the patch. Organizations that run their own Ruby builds or container images must update Ruby as well. Alpine cites Ruby fixes in 3.3.13, 3.4.12 and 4.0.9 or later.

SecurityWeek quoted Alpine's notice saying that upgrading GitLab “is not enough” for admins who run their own Ruby. That warning is easy to miss on a server where GitLab was installed from source or a custom image, so check those hosts separately.

What the KEV listing and federal deadline mean

KEV is CISA's catalog of vulnerabilities with confirmed exploitation. Adding CVE-2026-97229 on Thursday, Oct. 29, turns a warning from researchers into a federal finding that attacks are happening. That matters because Rapid7 had earlier said exploitation was unconfirmed. That statement predates the CISA listing and should now be read as superseded.

Under BOD 26-04, federal agencies must patch within about three days, according to SecurityWeek. Counting from Oct. 29 points to Sunday, Nov. 1, by our calculation. Reports describe the deadline differently, and one says agencies must act by Sunday, so check CISA's KEV entry for the official date.

The directive applies to federal civilian agencies. CISA urges all organizations to follow the catalog, though, and a private company running a self-hosted instance faces the same exploit. USA 24 also covered a Cisco firewall VPN zero-day with its own Nov. 1 federal deadline, so federal IT teams may be working two emergency patches the same weekend.

How exposed GitLab servers are right now

The public exposure figures are dated. A Daily Security Review report said Censys counted 25,766 internet-facing hosts running vulnerable versions when the proof-of-concept was published. The same report cites a separate tally that found about 31% of 82,454 detected GitLab hosts unpatched.

Those numbers came from October, and no current count of vulnerable internet-facing hosts turned up in the sources reviewed. Treat them as a rough sense of scale, not a live inventory.

GitLab has had a difficult year for critical bugs. An earlier maximum-severity flaw, CVE-2026-85706, drew exploitation probes within hours of disclosure, according to the same Daily Security Review report. Cybersecuritynews reported that CISA has listed six GitLab vulnerabilities as exploited since November 2021, and two of those were added in February 2026.

Several questions remain open. The sources reviewed do not say who was behind the Alpine attempt, whether any other organization was compromised, or whether the flaw is tied to ransomware.

Steps to take on your GitLab servers this weekend

• Inventory every GitLab instance, including forgotten test, staging and build servers.
• Upgrade each one to 19.4.2, 19.3.5 or 19.2.8, matching your release line, or to any later version.
• If you build Ruby yourself or run custom container images, update Ruby to 3.3.13, 3.4.12, 4.0.9 or later.
• Review recent changes to .gitlab-ci.yml files and activity on public projects for commits you did not expect.
• Check logs for crashes, 502 errors and unusual pipeline requests, the symptoms Alpine saw during its attempted attack.
• If an unpatched instance was reachable from the internet, rotate passwords, access tokens and secret keys. Alpine's rebuild reset passwords and secret keys as part of its response.

What comes next for GitLab admins

Alpine was targeted eight days after GitLab published its patches, which shows how short the gap between release and attack can be. Admins who waited for a convenient maintenance window have less room than they had in October.

Three developments bear watching. The first is whether CISA revises the KEV entry or its deadline language, since reports disagree on the timing. The second is whether attackers turn to CVE-2026-110264, which the current patch does not fix. The third is whether the people behind the Alpine attempt are identified or other victims come forward.

Patch gaps are a recurring problem in these listings. USA 24 reported on a case where CISA added the Node2Shell Brotli flaw to KEV while Node.js patches lagged. The GitLab case shows the same pattern, and the teams that patch fastest will spend the least time explaining why they did not.