As reported by BleepingComputer, CISA has added CVE-2026-97229 to its Known Exploited Vulnerabilities (KEV) Catalog, confirming active exploitation of a maximum-severity flaw in GitLab's CI/CD Regular Expression Compiler. Discovered by researcher 'joaxcar,' this integer overflow vulnerability allows unauthenticated remote attackers to execute arbitrary code via a specially crafted regular expression in pipeline configuration files. GitLab released patches on October 30 for CE and EE versions 19.4.2, 19.3.5, and 19.2.8 — but with Shadowserver tracking approximately 2,800 Internet-exposed Community Edition instances, the attack surface remains substantial.

Security Impact: As reported by BleepingComputer, CISA has added CVE-2026-97229 to its Known Exploited Vulnerabilities (KEV) Catalog, confirming active exploitation of a maximum-severity flaw in GitLab's CI/CD Regular Expression Compiler.

Why This Matters

This vulnerability is exceptional in its combination of characteristics: it requires no authentication, targets a core CI/CD component that processes untrusted input, and results in arbitrary code execution on the GitLab server itself. The attack vector — a malicious regular expression embedded in CI/CD configuration — is particularly insidious because it abuses a legitimate feature that development teams use daily.

GitLab instances are high-value targets. They serve as centralized repositories for source code, deployment pipelines, secrets, access tokens, and infrastructure configuration. A successful compromise gives attackers a foothold that can cascade into source code tampering, secrets theft, supply chain attacks, and lateral movement into production environments.

Vulnerability Details

AttributeDetail
CVE IDCVE-2026-97229
SeverityCritical (Maximum Severity)
Root CauseInteger overflow in CI/CD Regular Expression Compiler
Authentication RequiredNo — unauthenticated remote exploitation
ImpactArbitrary code execution on GitLab server
Affected ProductsGitLab CE and EE (versions prior to 19.4.2, 19.3.5, 19.2.8)
Patched Versions19.4.2, 19.3.5, 19.2.8
Active ExploitationYes — confirmed by CISA KEV catalog entry
Discovery CreditResearcher 'joaxcar'

Who Is at Risk

Self-managed GitLab deployments are the primary target — particularly organizations that expose their instances directly to the internet. Cloud-hosted GitLab.com instances are managed by GitLab and have been patched, but self-hosted CE and EE instances in DevOps-heavy environments, technology companies, and any organization running CI/CD pipelines face the highest exposure. The approximately 2,800 internet-facing CE instances tracked by Shadowserver represent the most immediately endangered population.

This is also part of a troubling pattern for GitLab in 2026. Earlier this year, the platform addressed CVE-2026-0723 (2FA bypass), CVE-2026-110264 (another maximum-severity regex compiler flaw), and CVE-2026-85706 (repository commits API data exposure). The recurrence of regex compiler vulnerabilities in particular suggests a systemic issue in how GitLab validates and processes regular expressions — defenders should treat this component as persistently risky.

The fact that this is the second maximum-severity Regular Expression Compiler flaw in a single month should prompt security teams to reassess whether self-managed GitLab instances belong on the internet at all.

Shield53 Recommendations

Immediate Actions

Shield53 Recommendations
Patch immediately: Upgrade to GitLab CE/EE 19.4.2, 19.3.5, or 19.2.8 depending on your branch. Do not delay — the KEV listing means active scanning is underway.
Restrict internet exposure: If your GitLab instance does not require public access, place it behind a VPN, zero-trust gateway, or IP allowlist immediately. This single control would have neutralized most exploitation attempts observed to date.
Rotate secrets proactively: If your instance was exposed and unpatched during the exploitation window, assume compromise. Rotate CI/CD variables, deploy tokens, SSH keys, API tokens, and any credentials stored in GitLab CI/CD pipelines.
Review audit logs: Examine GitLab audit logs and application logs for anomalous CI/CD pipeline executions, unexpected user account creation, or configuration changes. GitLab has released threat detections — deploy them now.
Monitor for IOCs: Watch for malicious regex patterns in merge requests and CI/CD configuration files. Scrutinize any pipeline configuration that references unusually complex or obfuscated regular expressions from untrusted contributors.

Longer-Term Hardening

  • Implement network segmentation: GitLab instances should reside in a restricted network zone with controlled egress. Treat the GitLab server as critical infrastructure, not a convenience tool.
  • Enforce mandatory code review: Require approval for all CI/CD configuration changes. This vulnerability's vector — a crafted regex in pipeline config — is exactly the type of change that structured review should catch.
  • Adopt a patch SLA for critical infrastructure: CISA's BOD 26-04 gives federal agencies a tight deadline. Private organizations should adopt a similar standard — 72 hours or less for critical-severity patches on internet-facing systems.
  • Inventory and reduce attack surface: Map all self-managed GitLab instances across your environment. Shadowserver's count of 2,800 exposed instances suggests many organizations are unaware of their own exposure.

The convergence of unauthenticated access, critical impact, confirmed exploitation, and a large exposed attack surface makes CVE-2026-97229 one of the most urgent patching priorities of the quarter. Organizations that treat GitLab as mere developer tooling rather than critical infrastructure are learning — the hard way — that CI/CD platforms are now primary targets in the modern attack chain.