A vulnerable CI/CD server can put more than source code at risk. Start with the server and the trust it holds for builds and deployments.
New on October 29, 2026: CISA added CVE-2026-97229 to KEV, confirming exploitation. The November 1, 2026 due date is a federal deadline, not automatically an MSP/customer obligation. CISA marks forensicTriage: Yes and ransomware use Unknown. GitLab’s original fix notice was published October 12; this alert is the new exploitation/KEV information, not a newly released patch.
Applicability and available fixes
GitLab rates this Critical, CVSS 3.1 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). A crafted regular expression in CI/CD configuration can allow unauthenticated server code execution. Check Community Edition and Enterprise Edition in these release families:
| Affected range | First fixed release |
|---|---|
| 19.2.x before 19.2.8 | 19.2.8 |
| 19.3.x before 19.3.5 | 19.3.5 |
| 19.4.x before 19.4.2 | 19.4.2 |
Use a supported, compatible patched release; do not infer that unlisted older releases are safe. GitLab.com and Dedicated had vendor-managed patching before the October 12 notice; that does not establish a self-managed instance is fixed.
Suggested MSP priority: urgent where applicable
Inventory → containment: locate self-managed GitLab instances, running builds, exposure and CI/deployment integrations. If an affected instance remains reachable, restrict unnecessary access through tested controls while arranging remediation. Preserve useful logs and volatile evidence where feasible without delaying containment. If suspicious activity is found, engage the authorized response process and assess accessible build/deployment credentials; patching alone does not remove persistence.
Patch → verify: follow GitLab’s supported upgrade path, compatibility and backup guidance; update the actual server deployment, including all applicable nodes/images. Confirm running builds after rollout and test authentication, pipelines, runners and deployment integrations. Review the vendor’s detection guidance, while treating absent indicators as insufficient evidence of a clean system. No complete GitLab-specific workaround or blanket credential-rotation mandate is asserted here.
Shared Ruby dependency caveat
Ruby’s October 23 notice maps the underlying Onigmo integer-overflow fix to 4.0.8, 3.4.12 and 3.3.13; it recommends 4.0.9, 3.4.12 or 3.3.13 and later for the complete related set. Other applications need an actual path compiling attacker-controlled regex strings; static developer-authored patterns are outside that stated scope. Regexp.timeout and pattern-length limits are not reliable protection. Ruby advises avoiding compilation of untrusted patterns when an upgrade is unavailable. For GitLab, use its supported product upgrade rather than replacing bundled Ruby ad hoc. Do not extend KEV status to every related CVE or every Ruby application.
Official sources
CISA KEV official catalog · GitLab October 12 patch advisory · Ruby’s October 23 dependency guidance · CISA federal implementation/forensics guidance
Last verified: October 29, 2026. Validate applicability for each environment; no customer use or compromise is assumed.