Over 1,000 Internet‑Exposed GitLab Servers Remain Unpatched for Critical RCE Flaw (CVE‑2026‑97229)
What Happened — A maximum‑severity integer‑overflow bug in GitLab’s CI/CD Regular Expression Compiler (CVE‑2026‑97229) allows an unauthenticated attacker to execute arbitrary code. GitLab issued patches for Community and Enterprise editions on Oct 12 2026, but Shadowserver’s scans on Nov 2 2026 still show more than 1,000 publicly reachable GitLab instances running vulnerable versions. The U.S. CISA has added the flaw to its Known Exploited Vulnerabilities (KEV) catalog and ordered federal agencies to remediate by the following Sunday. Exploitation is already observed in the wild, and the same flaw follows a series of recent GitLab vulnerabilities that have been actively abused.
Why It Matters for Trust & Control Assurance — The incident highlights the need for a robust vulnerability‑management control that guarantees timely patching and continuous evidence of remediation across all environments.
Who Is Affected — SaaS and self‑managed DevOps platforms, software‑development teams, and any organization that hosts its own GitLab instance (technology, financial services, healthcare, etc.).
Recommended Actions
- Inventory every GitLab deployment (cloud, on‑prem, dedicated).
- Verify the running version against the patched releases (19.4.2, 19.3.5, 19.2.8).
- Apply the security updates immediately; enable automated patch management where possible.
- Subscribe to CISA’s KEV feed and monitor for further GitLab advisories.
- Capture remediation evidence (patch logs, configuration snapshots) for audit readiness.
Technical Notes — The flaw resides in the regex compiler used to parse pipeline configuration files; an integer overflow can be triggered by a crafted regular expression, leading to remote code execution without authentication. CVE‑2026‑97229 is rated CVSS 9.8 (Critical). Source: BleepingComputer