Critical GitLab CI/CD Regex Compiler Flaw (CVE‑2026‑97229) Actively Exploited in the Wild
What Happened — The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed active exploitation of a critical GitLab vulnerability (CVE‑2026‑97229) that was patched earlier this month. The flaw resides in the CI/CD Regular Expression Compiler, where an integer overflow allows an unauthenticated attacker to execute arbitrary code by supplying a malicious regular expression in a pipeline configuration file. GitLab released patches for Community and Enterprise editions (versions 19.4.2, 19.3.5, 19.2.8) and issued detection rules for self‑managed instances. CISA added the CVE to its Known Exploited Vulnerabilities (KEV) catalog and, via Binding Operational Directive 26‑04, ordered federal agencies to remediate by the following Sunday, urging the broader community to do the same. Shadowserver reports roughly 2,800 Internet‑exposed GitLab CE instances, though the proportion already patched is unknown.
Why It Matters for Trust & Control Assurance — This incident tests the effectiveness of your vulnerability‑management and patch‑deployment controls, a single control objective that maps to many frameworks (e.g., NIST CSF, ISO 27001).
Who Is Affected — Software development platforms, SaaS providers, and any organization running self‑managed GitLab instances (technology, finance, government, etc.).
Recommended Actions
- Apply the GitLab patches (19.4.2, 19.3.5, 19.2.8) immediately.
- Enable GitLab’s released threat‑detection rules and verify alerts.
- Review CI/CD pipeline validation processes to reject unsafe regular expressions.
- Document the remediation steps and retain evidence for audit purposes.
- Incorporate this CVE into your continuous vulnerability‑scanning program.
Source: BleepingComputer
Technical Notes
- Attack vector: Exploitation of an integer overflow in the CI/CD Regular Expression Compiler.
- CVSS: Critical (exact score not disclosed).
- Data at risk: Potential execution of arbitrary code on the GitLab server, leading to full system compromise.
- Remediation: Patches released for CE 19.4.2 / EE 19.4.2 (and back‑ported to 19.3.5, 19.2.8).