GitLab patches a CVSS 10.0 flaw: a crafted regex now runs code with no authentication at all
On October 12, 2026, GitLab shipped a critical patch closing 24 flaws, including CVE-2026-97229, a CVSS 10.0 integer overflow in the CI/CD regular-expression compiler that is exploitable without authentication. Every operator of a self-managed instance should move to 19.4.2, 19.3.5 or 19.2.8 immediately, because this one no longer even asks for an account.
October 12, 2026. GitLab releases versions 19.4.2, 19.3.5 and 19.2.8 for both Community and Enterprise editions, a critical patch that closes 24 flaws. October 12, 2026. The worst of them, CVE-2026-97229, scores the maximum CVSS 10.0 and lets an unauthenticated attacker run code on the server through a crafted regular expression in a CI/CD configuration. October 12, 2026. GitLab.com is already running the fixed version. Why it matters: three weeks ago a nearly twin flaw still required a valid account to exploit — this one does not, which changes the urgency of the fix for self-managed instances.
A critical flaw with no prerequisites
CVE-2026-97229 is an integer overflow in the regular-expression compiler that validates CI/CD pipeline rules. The CVSS vector leaves no room for debate: AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H — network reachable, low complexity, no privileges required, no user interaction, full confidentiality-integrity-availability impact with a scope change. That is the definition of a 10.0.
The chain reads like this: an attacker submits a rule containing a hostile regular expression to the pipeline analyzer; the server compiles it; the resulting memory corruption turns into code execution inside the GitLab process. Because config validation is the entry point, the attacker needs no account, no repository access and no compromised runner. The flaw was reported by researcher joaxcar — the same person behind September’s two 9.9s — through the HackerOne bug bounty program.
The affected range covers almost every recent deployment: all of 19.2 before 19.2.8, all of 19.3 before 19.3.5, and all of 19.4 before 19.4.2.
Same family as September, one notch worse
The patch from September 23, 2026 already closed two remote-code-execution flaws at CVSS 9.9 in the same code path: CVE-2026-89078, a double free, and CVE-2026-93577, an integer overflow in the regex compiler. The common thread was the PR:L requirement — you had to be authenticated, even without admin rights.
CVE-2026-97229 closes that gap by removing the requirement entirely. The CI/CD configuration’s regex compiler is still the entry point, but the access bar drops to zero. The progression from September to October maps an uncomfortable trend: this engine, historically written in C and reused by Ruby under GitLab, keeps accumulating bug classes — double free, integer overflow — and each iteration widens the exploitable surface.
The rest of the release confirms the patch is not about a single flaw. CVE-2026-92883, a High-severity XSS in syntax highlighting, lets an authenticated user run JavaScript in other users’ sessions via a crafted repository. CVE-2026-16301 and CVE-2026-14814, also High, hit authorization in the downstream-pipeline creation service and a permissive regex in file access. A long tail of Medium issues touches GraphQL API authorization, the package registry and custom roles. Twenty-four fixes in all — and one alone justifies the urgency.
Pipeline-as-code becomes the attack surface
The entry point for this flaw is not an exotic service; it is the CI/CD configuration itself. only and except rules, workflow:rules and variable filters all accept regular expressions, and GitLab compiles them on every pipeline evaluation. Pipeline-as-code moved build logic into repositories — a reproducibility win — but it also widened the trust boundary: anything that influences what the server compiles becomes a surface executed server-side.
With CVE-2026-97229, that surface is reachable without an account. A regular expression is not inert data: compiling one means running a small program, and an unmanaged engine turns that program into an execution primitive. The deeper defense does not replace the patch — it complements it: restrict who can push to repositories that feed pipelines, watch audit logs for unusually modified configurations, and treat the GitLab server as the critical asset it has become. It holds your source code, your CI/CD secrets and, increasingly, the control plane for AI agents.
Migrations and maintenance windows
The patch ships with database migrations, which has a direct operational consequence. On a single-node instance, the upgrade causes downtime while migrations complete before GitLab can start. On a multi-node instance, the zero-downtime upgrade procedures apply the patch without an outage — provided you follow them to the letter. Version 19.3.5 also includes post-deploy migrations.
For a Docker-based instance, the version bump is straightforward:
# Docker (official image) — move to the October 12 critical patch
docker pull gitlab/gitlab-ee:19.4.2-ee.0
docker compose up -dGitLab.com already runs the fixed version, and GitLab Dedicated customers have nothing to do. Self-managed instances carry the risk.
How to know if you were hit
Exploitation of this class leaves no obvious trace: execution happens inside the GitLab server process, not an isolated runner. The usable signals are indirect — a pipeline repeatedly failing on a regex rule, unusually long or nested expressions in recently modified .gitlab-ci.yml files, a sudden CPU spike on the server during pipeline evaluation. Cross-reference these with the audit logs, which record who changed which configuration and when.
When in doubt, compare the .gitlab-ci.yml modification history against pipeline error spikes: an exploitation attempt almost always leaves a trace in one of the two.
Verdict
If you operate a self-managed GitLab instance, move to 19.4.2, 19.3.5 or 19.2.8 without delay — a 10.0 exploitable without authentication leaves no room for triage, and a compromised DevSecOps control plane hands the attacker code, secrets and deployments. If you run a multi-node instance, schedule the zero-downtime upgrade rather than a hard cut, but do not postpone the patch. And if prevention is your priority, treat the CI/CD surface as a trust boundary to shrink: with this bug family, the right to modify a pipeline configuration now equals the right to execute code on the server — and no one needs an account to try.