Skip to contentistheinternetok
All incidents

Security flaw·Critical

GitLab servers: critical flaw now used in attacks

Fix availableAttackers already use itAffects website owners
GitLab Community and Enterprise Edition (self-managed)

What it changes for you

Nothing visible for you; teams running their own GitLab must update.

A flaw in self-hosted GitLab lets an attacker run code on the server through a crafted CI/CD setting, no account needed. GitLab fixed it on October 12 and CISA says attackers now use it.

Started Oct 12, 2026Updated Oct 29, 2026

Post on X

What should I do?

You
Nothing to do. GitLab.com is already patched.
If you run a website or an app
Upgrade self-managed GitLab to 19.4.2, 19.3.5 or 19.2.8 or later, then check servers for signs of compromise. Other Ruby apps that compile regular expressions from user input should move to Ruby 4.0.9, 3.4.12 or 3.3.13.

What is affected

CVE-2026-97229Severity score 10 out of 10

Timeline

  1. Fix available · Oct 29, 2026

    CISA adds CVE-2026-97229 to its Known Exploited Vulnerabilities catalog.

    CISA

  2. Fix available · Oct 23, 2026

    Ruby publishes fixes for the underlying regular expression bugs, which can affect other apps.

    Ruby

  3. Fix available · Oct 12, 2026

    GitLab releases 19.4.2, 19.3.5 and 19.2.8 fixing CVE-2026-97229 (CVSS 10), a remote code execution flaw with no login needed.

    GitLab

Sources