GitLab has released updates for a maximum-severity flaw in its Community and Enterprise Editions that could let an attacker without an account run arbitrary code on a self-managed GitLab server, and is urging customers who host the software themselves to upgrade immediately. Because these servers hold source code and the credentials used to build and ship software, a compromise could reach well beyond the machine itself. BleepingComputer reported the warning Monday, and CERT-EU, the cybersecurity service for European Union institutions, issued an advisory the same day.

What Happened

GitLab's patch release, dated Oct. 12, ships versions 19.4.2, 19.3.5 and 19.2.8. The critical bug, CVE-2026-97229, carries the top score of 10.0 on the Common Vulnerability Scoring System. It is an integer overflow, an arithmetic error in which a number outgrows the space reserved for it, in the component that compiles regular expressions, the text-matching patterns written into CI/CD configuration files. CI/CD, short for continuous integration and continuous delivery, is the automated pipeline that tests and builds code. GitLab says that under certain conditions a specially crafted pattern could let an unauthenticated user execute code on the server because such patterns were not validated properly.

Affected are releases 19.2 before 19.2.8, 19.3 before 19.3.5 and 19.4 before 19.4.2. BleepingComputer and CERT-EU's advisory give 19.3.4 as the fix for the 19.3 branch, but GitLab's own page lists 19.3.5 and says 19.3.4 had a known bug that broke merge request pages when the Ona integration was enabled.

RelatedNew curl Release Fixes 24 Flaws, Including a High-Severity Bug Reported With Anthropic’s Claude

GitLab.com already runs the fix, and customers of GitLab Dedicated, the company's single-tenant hosted service, need not act. The update includes database migrations, so single-node installations will go offline while it applies; multi-node setups can use zero-downtime procedures.

A researcher using the handle "joaxcar" reported the flaw through GitLab's HackerOne bug bounty program. None of the sources reviewed reports exploitation or public attack code, and the bug is absent from the latest version of CISA's Known Exploited Vulnerabilities (KEV) catalog, dated Oct. 8. The KEV catalog is the U.S. government's list of flaws confirmed to be under attack.

Why It Matters

A build server is a software supply-chain chokepoint. Code execution there can expose proprietary source code, pipeline secrets and deployment credentials, and could let an intruder tamper with software before it ships to customers. GitLab says it has more than 30 million registered users and that more than half of Fortune 100 companies use its platform, according to BleepingComputer.

The risk sits with organizations that run GitLab on their own infrastructure, including public bodies. CERT-EU "strongly recommends upgrading all self-managed GitLab CE/EE instances" and advises starting with those reachable from the internet. Leaders should ask who owns the upgrade, whether any instance is exposed online and when the downtime window is scheduled.

The release fixes 23 other security issues: five high, 14 medium and four low severity. The high-severity fixes include a cross-site scripting bug in syntax highlighting (8.7), an authorization flaw in downstream pipeline creation (8.5), an overly broad pattern in repository file access that could poison cached responses and expose protected CI/CD variables (8.2), and a prompt injection flaw in GitLab Duo Agent Platform, the company's AI agent product (7.3).

Context

GitLab bugs have drawn attackers quickly before. BleepingComputer notes that after GitLab patched a maximum-severity path traversal flaw, CVE-2026-85706, last month, CISA added it to the KEV catalog a day later and gave federal agencies three days to secure their systems. CISA has flagged five GitLab flaws as exploited since November 2021, one of them used by ransomware gangs, the outlet reported. Earlier this month, GitLab also fixed a critical sandbox escape in its self-hosted AI gateway.

What to Watch

  • Proof-of-concept code or reports of attacks, and whether CISA adds CVE-2026-97229 to the KEV catalog.
  • Patch uptake on internet-facing self-managed instances, which CERT-EU singles out as the first priority.
  • GitLab's publication of the issue details 90 days after the release, which will show defenders and attackers alike how the bug works.