GitLab RCE actively exploited, unauthenticated (CVE-2026-97229) [PoC]

Actively exploited in the wild - CVE-2026-97229 is a critical unauthenticated remote code execution flaw in GitLab CE/EE (19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2) that lets an attacker with no account run arbitrary code on the GitLab server via a crafted regular expression in a CI/CD configuration. Patched in 19.2.8, 19.3.5, and 19.4.2 - update immediately.

Overview

CVE-2026-97229 is a regular expression injection flaw in GitLab’s CI/CD pipeline handling. GitLab uses regular expressions in a number of CI/CD features - things like rules:if conditions, only and except clauses, and variable matching. When a pipeline configuration supplies a regular expression, GitLab is supposed to validate and safely evaluate it. In the affected versions, that validation is insufficient. A specially crafted regex reaches the server-side regex engine in a way that lets an attacker break out of the intended matching context and execute code.

The attacker does not need an account, a token, or any form of authentication. They only need to be able to submit or influence a CI/CD configuration that GitLab processes - for example through a pipeline trigger, a merge request from a fork, or any path where untrusted configuration reaches the parser. Attack complexity is low, and no user interaction is required, which is why the CVSS score is a full 10.0.

Impact

Successful exploitation gives the attacker arbitrary code execution on the GitLab server, running with the privileges of the GitLab application. That is effectively the keys to the kingdom: source code, CI/CD secrets, deployment credentials, registry images, and any tokens stored in project or group variables. Because GitLab often sits at the center of an organization’s software supply chain, a compromise here can be used to tamper with build artifacts and reach downstream production systems. CISA has added this CVE to its Known Exploited Vulnerabilities catalog, confirming attacks against real targets. EPSS estimates an 18.4% probability of exploitation in the next 30 days.

Remediation and Mitigation

• Upgrade now. GitLab has released fixed versions: 19.2.8, 19.3.5, and 19.4.2. Move any exposed instance to the matching patched release for its track.
• Restrict untrusted pipeline configuration. Until you can patch, disable or tightly limit CI/CD features that process regex from untrusted sources, such as pipelines triggered from forks or external contributors.
• Hunt for indicators. Review GitLab logs for unexpected pipeline runs, unfamiliar trigger tokens, and outbound connections from the GitLab host. Rotate CI/CD variables, runner tokens, and any secrets reachable from the application.
• Assume compromise if exposed. If your instance was internet-facing and unpatched, treat credentials and source code as potentially leaked.

Related: GitLab CVSS 10 file-read bug probed in the wild.

Security Insight

This is the second recent GitLab issue to draw real-world attack traffic, and both sit in the same place: the boundary between untrusted pipeline input and server-side processing. CI/CD is the most privileged part of a modern DevOps platform, so a validation gap there carries far more weight than the same gap in a feature nobody automates. The uncomfortable lesson is that “safe” regex handling is a hard problem, and treating user-supplied patterns as trusted has now produced a maximum-severity, actively exploited bug.

Further Reading

• GitLab CVSS 10 file-read bug probed in the wild
• All Critical Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs