Critical GitLab RCE Vulnerability (CVE-2026-97229) Gets Public Exploit

Key Takeaways

• A critical remote code execution (RCE) vulnerability, CVE-2026-97229, in GitLab’s CI/CD regular-expression compiler now has a public proof-of-concept (PoC) exploit.
• The flaw affects GitLab Community Edition (CE) and Enterprise Edition (EE) versions 19.2, 19.3, and 19.4 prior to their respective patch releases.
• Rated with a maximum CVSS score of 10.0, the vulnerability allows an authenticated attacker with push access to a public project to execute arbitrary commands.
• Patches were released on October 12, 2026, and self-managed GitLab instances are strongly advised to upgrade immediately.

A critical vulnerability within GitLab’s CI/CD regular-expression compiler, identified as CVE-2026-97229, now poses an elevated risk to unpatched systems following the public release of a proof-of-concept (PoC) exploit. Cybersecurity researcher Jonah Burgess published the PoC, demonstrating how the flaw can be leveraged to achieve remote command execution on vulnerable GitLab servers.

GitLab has assigned this issue a critical severity rating, with a CVSS score of 10.0, the highest possible. The availability of exploit code significantly increases the urgency for organizations to implement the necessary security updates to protect their installations.

Exploit Details and Conditions

The newly published PoC targets both GitLab Community Edition and Enterprise Edition. Its creator, Jonah Burgess, confirmed successful tests against the official Linux amd64 GitLab CE 19.4.1 image. The exploit chain specifically utilizes GitLab’s CI lint endpoint, a feature designed to validate CI/CD configuration files.

A key prerequisite for successful exploitation is that the attacker must possess permissions to push a branch to a public project on the targeted GitLab instance. Once this condition is met, the PoC demonstrates how a subsequent request to the CI lint endpoint can be made without requiring any further authorization headers, tokens, or cookies.

Jonah Burgess clarified that commands executed via this method run under the privileges of GitLab’s ‘git’ account, not as an administrator. Burgess also noted that the public code represents an initial release, with ongoing analysis into other potential exploitation paths and affected configurations still underway.

Technical Breakdown of the Vulnerability

GitLab’s official advisory describes CVE-2026-97229 as an integer overflow occurring within the CI/CD regular-expression compiler. The PoC outlines a sequence where the CI lint process reads a specially crafted pipeline configuration from an attacker-controlled branch. This configuration then processes a regular expression against repository paths that are specifically named to trigger the vulnerability.

The core of the exploit involves a Unicode path that causes Ruby to recompile the regular expression, bypassing GitLab’s initial size checks. This recompilation, according to the exploit authors, leads to an integer overflow. The overflow subsequently redirects the execution flow of the regular-expression engine, ultimately reaching a command-execution function.

During testing, the exploit often results in an HTTP 502 error, indicating that the worker process crashes after the command has been executed. This error alone does not confirm successful exploitation. However, as detailed in Jonah Burgess author’s tests, command output retrieved through a callback mechanism confirmed successful execution. The PoC also demands substantial memory resources and is tailored to a specific GitLab build. Burgess cautioned that environments with low memory or those experiencing multiple concurrent requests might instead suffer service disruptions.

Affected Versions and Remediation

GitLab confirmed that the vulnerability impacts CE and EE versions 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. The company released these critical security updates on October 12, 2026, and has strongly urged all self-managed installations to upgrade without delay.

GitLab.com instances are already operating on patched versions, and GitLab Dedicated customers are not required to take any action. Administrators of self-managed instances must verify their current GitLab version and upgrade to the corresponding fixed release for their branch or to a newer, supported version.

What You Should Do

• Upgrade Immediately: For self-managed GitLab instances, prioritize upgrading to the patched versions: 19.2.8, 19.3.5, 19.4.2, or any later supported release.
• Review CI/CD Configurations: Scrutinize recent changes to CI/CD configuration files, paying close attention to new or modified regular expressions and project branches.
• Monitor for Suspicious Activity: Keep an eye on system logs for any unusual activity, especially related to the ‘git’ account or unexpected process crashes.
• Restrict Project Access: Ensure that push permissions to public projects are strictly controlled and granted only to trusted users.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.