CISA Confirms Active Exploitation of GitLab Vulnerability CVE-2026-97229

Severity

High

Detail

CISA has confirmed active exploitation of CVE-2026-97229, a critical remote code execution vulnerability affecting both GitLab Community Edition and GitLab Enterprise Edition. On October 29, 2026, the vulnerability was added to the Known Exploited Vulnerabilities (KEV) catalog, indicating that threat actors are actively targeting affected systems.

The vulnerability is attributed to insufficient regular expression validation within GitLab’s CI/CD functionality. According to the published advisory, unauthenticated attackers can exploit the flaw by supplying a specially crafted regular expression through CI/CD configurations, potentially resulting in arbitrary code execution on vulnerable GitLab servers. The flaw can be exploited remotely over the network, requires no user interaction, and does not require authentication.

The addition of the vulnerability to CISA’s KEV catalog confirms that exploitation activity is occurring in real-world environments beyond proof-of-concept demonstrations or theoretical attack scenarios.

How?

The vulnerability originates from insufficient validation of regular expressions processed within GitLab CI/CD workflows. Researchers reported that specially crafted input can trigger an integer overflow condition, resulting in unintended application behavior that attackers may leverage to execute arbitrary code on the affected server.

An attacker can exploit the vulnerability remotely by submitting a malicious CI/CD configuration containing specially crafted regular expressions. Because authentication is not required, internet-exposed GitLab instances may be targeted directly without valid user credentials.

Successful exploitation could allow attackers to execute arbitrary commands on the GitLab server, potentially leading to system compromise, unauthorized access to source code repositories, CI/CD pipelines, project data, and other sensitive resources managed by the affected platform.

CISA noted that active exploitation has been observed but did not publicly disclose specific attacker identities, campaign details, or victim organizations. The agency has required remediation of affected systems and included the vulnerability within its active exploitation tracking program.

Conclusion

The inclusion of CVE-2026-97229 in CISA’s Known Exploited Vulnerabilities catalog confirms that threat actors are actively targeting vulnerable GitLab servers. The combination of unauthenticated remote code execution, a maximum CVSS score, and active exploitation significantly increases the risk posed by this vulnerability.

Given GitLab’s widespread use in software development and CI/CD environments, successful compromise could provide attackers with access to sensitive source code, development pipelines, credentials, and organizational infrastructure. Organizations should prioritize patching affected systems and perform proactive threat hunting to identify signs of compromise.

Source

https://gbhackers.com/cisa-gitlab-vulnerability-cve-2026-97229/