Security reports have revealed that more than 1,000 GitLab platform servers are still running versions unprotected against a maximum-severity vulnerability, which is currently being exploited in Remote Code Execution (RCE) attacks.
This vulnerability, identified as CVE-2026-97229, stems from an integer overflow flaw in the Regular Expression Compiler component of the CI/CD environment. This flaw allows an unauthenticated user to execute arbitrary code on the server by sending specially crafted regular expressions within pipeline configuration files.
Why does this news matter?
The danger of this vulnerability lies in the nature of the GitLab platform, which is a cornerstone of DevSecOps operations, serving more than 70 million users and used by more than 50% of Fortune 100 companies. The ability to execute remote commands means the potential for full control over the server, which could lead to the theft of sensitive data, access to source code, or even the use of servers as a platform to launch other attacks.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, requiring federal agencies to secure their systems immediately. Although GitLab has released security updates since mid-October, the Shadowserver Foundation has observed that more than 1,000 servers remain exposed to the risk.
Escalating security context
This is not the first vulnerability of its kind for GitLab this year; the platform has seen a series of critical vulnerabilities, including a two-factor authentication (2FA) bypass vulnerability in January and a credential theft vulnerability in September.
To protect systems, GitLab has emphasized the need to upgrade all self-managed versions to one of the following versions immediately:
- GitLab Community Edition (CE): Versions 19.4.2, 19.3.5, or 19.2.8.
- GitLab Enterprise Edition (EE): Versions 19.4.2, 19.3.5, or 19.2.8.
It is noted that the GitLab.com version and the GitLab Dedicated service are already protected and do not require additional actions from users.