GitLab has patched a maximum-severity vulnerability that could have let an attacker run arbitrary code on a GitLab server without ever logging in. The flaw, tracked as CVE-2026-97229, received a CVSS score of 10.0, the highest possible rating, and affects both the Community Edition and Enterprise Edition of the platform.
According to GitLab, the issue stems from insufficient validation of regular expressions. An attacker could craft a malicious regular expression inside a CI/CD pipeline configuration, and under certain conditions that expression would let an unauthenticated user execute code on the server itself. CI/CD pipelines are the automated scripts GitLab runs to build, test and deploy software, so a flaw reachable through pipeline configuration touches one of the platform’s most sensitive components.
The vulnerability affects GitLab versions 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. GitLab has released patched versions 19.2.8, 19.3.5 and 19.4.2 and is urging self-managed instances to upgrade immediately. GitLab.com and GitLab Dedicated customers are typically patched automatically by GitLab itself. In its advisory, GitLab said it “has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code.”
The same patch release addresses three other significant flaws. CVE-2026-92883, rated 8.7, is a cross-site scripting bug reachable through a specially crafted repository that could run scripts inside another user’s browser session. CVE-2026-16301, rated 8.5, is an authorization flaw that could let a user with only Developer-level access trigger pipelines on protected branches, bypassing the access controls meant to guard production code. CVE-2026-14814, rated 8.2, is another overly permissive regular expression that could poison cached responses for raw repository files, potentially exposing protected environment variables that often hold secrets like API keys.
No confirmed exploitation of CVE-2026-97229 has been reported as of publication. That does not mean the risk is theoretical. GitLab has a recent history of critical flaws drawing fast attacks: we covered a separate critical GitLab bug in August 2026, CVE-2026-19478, which let unauthenticated attackers delete or modify public projects and was being exploited within two days of its patch. Security researchers tend to compare patched and unpatched versions of open-source software like GitLab within hours of a release, which can reveal the exact code change attackers need to build a working exploit.
Organizations running self-managed GitLab should treat this as an urgent patch. Anyone unable to update immediately should review who can create or modify CI/CD pipeline configurations and consider restricting pipeline execution to trusted maintainers until the upgrade is complete.
Source: The Hacker News, “GitLab Patches CVSS 10.0 Flaw That Could Let Unauthenticated Users Run Server Code,” October 13, 2026.
