More than 1,000 internet-exposed GitLab servers are still unpatched against CVE-2026-97229, a maximum-severity flaw exploited in remote code execution attacks, according to Shadowserver data from the weekend reported by BleepingComputer. The flaw is in the component that parses regular expressions in CI/CD pipeline configuration files and lets an unauthenticated user run code on the server.
GitLab released a fix on October 12 in Community Edition and Enterprise Edition versions 19.4.2, 19.3.5 and 19.2.8. On Friday, CISA confirmed the flaw is being exploited and added it to its Known Exploited Vulnerabilities (KEV) catalog, ordering federal agencies to secure their servers by Sunday.
What to do: anyone running self-managed GitLab should upgrade to one of the patched versions immediately. GitLab.com is already patched, and GitLab Dedicated customers do not need to take action.