Loading story…
GitLab released Community Edition and Enterprise Edition versions 19.2.8, 19.3.4, and 19.4.2 to address 24 security issues, including CVE-2026-97229, a critical vulnerability rated CVSS 10.0. The flaw could allow an unauthenticated attacker to execute arbitrary code through a specially crafted regular expression in CI/CD configuration. Reports describe an integer overflow and insufficient validation in the regular expression compiler, but GitLab has not disclosed a complete attack sequence or exact exploitation conditions. The release notice does not report real-world exploitation. The updates also fix five high-severity vulnerabilities and weaknesses involving cross-site scripting, unauthorized pipeline execution, cache poisoning, AI prompt injection, sensitive-data exposure, and authorization bypasses.
GitLab recommends immediately upgrading affected self-managed installations, with internet-facing deployments a priority; GitLab.com is already patched, and GitLab Dedicated customers need no action. Administrators should account for database migrations that cause downtime during single-node upgrades, while properly executed multi-node upgrades can avoid downtime. After patching, security teams should review logs and CI/CD configuration changes for suspicious activity and investigate connected systems if compromise is suspected. Two release caveats warrant attention: version 19.3.4 has a known merge request page bug when the Ona integration is enabled, and the advisory inconsistently lists all 19.3 versions as affected by CVE-2026-84284 despite naming 19.3.4 as a security patch release; administrators should seek clarification on that separate flaw's remediation status.
See affected versions and whether adversaries are exploiting it.
10 events from the most recent confirmed update back to the earliest known activity.
Researcher Jonah Burgess published a proof-of-concept tested against GitLab CE 19.4.1 that executes commands as the git account, requiring permission to push a branch to a public project before an unauthenticated CI lint request triggers exploitation. The exploit is build-specific, requires substantial memory, and may crash workers or disrupt service.
Contributor jheysel-r7 proposed a Metasploit module for CVE-2026-97229; a local demonstration on October 14 achieved a Linux x64 Meterpreter session as the git user on GitLab 19.4.1. The demonstrated workflow uses authenticated access to prepare a crafted CI configuration before triggering execution through an unauthenticated CI Lint request.
GitLab released AI Gateway versions 19.2.4, 19.3.2, and 19.4.1 to fix CVE-2026-90970, involving improper neutralization of special elements in a template engine. The advisory recommends that users of affected versions upgrade to fixed or newer releases.
Rapid7 independently reproduced arbitrary code execution as the GitLab git user on GitLab CE 19.4.1 with ASLR enabled; the same exploit input did not execute on patched version 19.4.2. Its demonstrated attack requires planting a malicious CI/CD configuration in a public project and triggering regular expression recompilation through a specially formed UTF-8 repository path.
GitLab released version 19.3.5 and recommends it instead of 19.3.4, which introduced a separate issue affecting merge request pages when the Ona integration was enabled. The updated guidance lists 19.3.5 as the recommended patched release for the 19.3 series affected by CVE-2026-97229.
Security researcher joaxcar reported an integer overflow vulnerability in GitLab's CI/CD regular expression compiler through HackerOne. The flaw could allow unauthenticated arbitrary code execution through a specially crafted regular expression.
GitLab released CE and EE versions 19.4.2, 19.3.4, and 19.2.8 with 24 security fixes, including CVE-2026-97229, rated CVSS 10.0, and urged affected self-managed installations to upgrade immediately. GitLab's advisory dates the release to October 8, while a secondary report gives October 12 for the same release.
GitLab patched CVE-2026-85706 in September 2026, a CVSS 10.0 vulnerability allowing unauthenticated attackers to read arbitrary server data, including passwords and other secrets. Security specialists subsequently observed exploitation attempts shortly after its disclosure.
GitLab patched critical CI/CD regular expression vulnerabilities that required authentication. The sources do not establish whether those flaws share an underlying cause with CVE-2026-97229.
GitLab released patches for CVE-2026-19478, a critical code injection vulnerability. The flaw could be exploited without authentication to modify or delete public projects and user data.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
32 references tracked. Mallory keeps watching after this page renders.
rapid7.com
Open sourcecryptika.com
Open sourcecybersecuritynews.com
Open sourcensfocusglobal.com
Open sourcecybersecuritynews.com
Open sourcelabs.beazley.security
Open sourcedocs.gitlab.com
Open sourceopennet.ru
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
GitLab released emergency security updates for **CVE-2026-110264**, a CVSS 10.0 vulnerability that could allow unauthenticated remote code execution on self-managed Community Edition and Enterprise Edition installations under undisclosed conditions. The flaw involves an integer overflow when compiling a specially crafted regular expression in Ruby’s Onigmo engine and affects releases dating back to version 7.0. Fixed versions are **19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13**, extending patches to four branches outside normal maintenance. The release addresses 12 vulnerabilities, including high-severity issues involving LDAP-backed account takeover and OAuth/OIDC discovery cache poisoning. **Self-managed administrators should upgrade immediately**, including those who installed the October 12 security updates; GitLab offers no interim workaround. GitLab.com and qualifying GitLab Dedicated deployments are already patched. GitLab reports no observed exploitation and has published two detection rules for potential exploitation attempts; single-node operators should plan for possible upgrade downtime. An earlier third-party report described a similar regex-related RCE under a different identifier, CVE-2026-97229, and cited fixes in versions 19.2.8, 19.3.4, and 19.4.2. Those technical claims remain unverified and should not be conflated with the current advisory or treated as evidence that those earlier versions remediate CVE-2026-110264.
Oct 22, 2026
GitLab Community Edition (CE) and Enterprise Edition (EE) updates address seven vulnerabilities, including the critical path-traversal flaw **CVE-2026-85706** and two critical CI/CD code-execution vulnerabilities, **CVE-2026-89078** and **CVE-2026-93577**. CVE-2026-85706 has a CVSS score of 10.0 and allows an unauthenticated remote attacker to read arbitrary files through the repository commits API because of improper path confinement and missing authentication enforcement. FortiGuard reported exploitation attempts across multiple countries and sectors, while CISA added the flaw to its Known Exploited Vulnerabilities catalog. The two CVSS 9.9 CI/CD flaws can allow an authenticated user to execute arbitrary code on the GitLab server under certain conditions using specially crafted regular expressions in CI/CD configuration. Self-managed GitLab administrators should upgrade immediately: versions 19.2 should move to **19.2.7** or later, 19.3 to **19.3.3** or later, and 19.4 to **19.4.1** or later; earlier fixes for CVE-2026-85706 were released in 19.1.8, 19.2.6, and 19.3.2. Organizations should also review repository commits API logs for suspicious requests, particularly attempts to retrieve configuration or credential files.
Sep 29, 2026
GitLab released versions **19.3.2**, **19.2.6**, and **19.1.8** for Community Edition and Enterprise Edition, remediating 18 vulnerabilities. The most severe, **CVE-2026-85706** (CVSS 10.0), is an unauthenticated path-traversal flaw in the repository commits API that enables arbitrary file reads from vulnerable GitLab servers. GitLab also addressed authorization issues, cross-site scripting, CI/CD-variable exposure, and denial-of-service vulnerabilities. Enterprise Edition fixes include **CVE-2026-87719** (CVSS 9.9), an authenticated insecure-deserialization issue associated with Duo Chat/GraphQL subscription handling that can expose Advanced Search configuration and credentials, and **CVE-2026-88765** (CVSS 8.5), which can allow authenticated remote code execution through importing a crafted malicious Git project export. GitLab.com already runs the patched release and GitLab Dedicated customers need take no action; self-managed administrators should upgrade immediately and plan for database migrations, which require downtime on single-node deployments.
Sep 17, 2026