GitLab rated a CI/CD bug max severity on Monday. Self-managed servers must patch.
By Lior AharonovFounder, 7IT Solutions ·
On Monday 12 October 2026, GitLab told self-managed users to patch CVE-2026-97229, a maximum-severity flaw in its CI/CD Regular Expression Compiler. BleepingComputer reports that, under certain conditions, it could let an unauthenticated user run code on the server through a crafted regular expression in a CI/CD configuration. Fixed in 19.2.8, 19.3.4 and 19.4.2; GitLab.com already runs the fix.
Your GitLab server holds the source, the CI variables, the deploy keys to production. A regex in a pipeline file shouldn't be a way in. On an unpatched self-managed server, under certain conditions, it could be.
If you run GitLab CE or EE yourself, upgrade today to 19.2.8, 19.3.4 or 19.4.2, whichever matches your branch. GitLab Dedicated customers do not need to act, per GitLab.
Self-hosting GitLab makes you the security team for your crown jewels. Patch day is part of the deal.
Lior Aharonov · my takeSources
- BleepingComputer: GitLab warns of max severity code execution vulnerability bleepingcomputer.com
Researched with AI tools; every fact is checked against the linked sources.