CISA confirms the critical GitLab RCE bug is under active attack
CISA added CVE-2026-97229 to its Known Exploited Vulnerabilities catalog on 29 October, confirming attacks on the GitLab CI/CD flaw patched over two weeks earlier, with federal agencies given until Sunday to fix it.
CISA added CVE-2026-97229 to its Known Exploited Vulnerabilities catalog on 29 October, confirming active exploitation of the maximum-severity GitLab bug that GitLab itself patched more than two weeks earlier, on 12 October.
The flaw is an integer overflow in GitLab’s CI/CD regular expression compiler, rated CVSS 10.0, and lets an unauthenticated attacker run code on the server through a crafted regular expression in a pipeline configuration. It affects self-managed Community and Enterprise Edition installs before 19.4.2, 19.3.5 and 19.2.8. Scans of internet-exposed servers still count nearly 2,800 unpatched Community Edition instances online. CISA’s binding directive gives federal agencies until Sunday, 1 November, to secure their installs, and the agency has now listed six exploited GitLab vulnerabilities since November 2021.
Why it matters: if you run GitLab yourself rather than using GitLab.com, this is no longer a theoretical patch-when-you-can bug. It is being used right now. Check your version is at least 19.4.2, 19.3.5 or 19.2.8, and patch today if it isn’t.
The caveat: neither CISA nor GitLab has published how the exploitation is being carried out or an indicator-of-compromise list, so there’s nothing specific yet to search your logs for beyond unusual CI/CD regex activity.