CISA puts GitLab's max-severity CI regex flaw on the exploited list

CISA has added CVE-2026-97229 to the Known Exploited Vulnerabilities catalog. The score in public accounts is 10.0. The failure sits in GitLab’s CI/CD regular-expression handling: an integer overflow that, with a malicious expression in pipeline configuration and weak validation, can let an unauthenticated party run code on the server. That is not a niche misconfiguration. It is a platform bug with a root-shaped outcome.

BleepingComputer reported the KEV move on October 30, 2026. The Hacker News carried the same listing alongside a Cisco firewall denial-of-service entry. GitLab had already shipped fixes in Community Edition and Enterprise Edition builds 19.4.2, 19.3.5, and 19.2.8 and had published detections for self-managed customers after seeing exploitation attempts. The catalog entry is the federal stamp that the attempts are real.

The public record already has a near-miss

Alpine Linux described an unpatched instance probed on October 20 and 21, 2026. Crafted CI configurations crashed worker processes repeatedly. Some crashes stopped before the next stage. The distribution rebuilt the instance anyway and said it found no tampering in aports, packages, or the October 21 releases. Later return visits were blocked. “Close to working” is not a reason to wait for a confirmed breach photo. It is a reason to assume the next shop will not be as lucky.

Shadowserver’s public counts put thousands of GitLab Community Edition instances on the open internet. That population is the audience for unauthenticated bugs in CI parsing. A self-managed box with a public URL and an old minor version is a target whether or not the org thinks of itself as a software company.

What changes for operators

Federal civilian agencies sit under Binding Operational Directive 26-04 with a patch-by date of November 1, 2026 in the reporting. Private teams are not on that memo. They are on the same exploit timeline. Install the fixed GitLab package your edition names, restart the services the advisory requires, and confirm the version string. Apply GitLab’s published detections if you run self-managed and can ingest them.

Do not stop at the binary. Review recent CI configuration changes, especially expressions landed by accounts you do not recognize. Treat an internet-facing GitLab that was unpatched through late October as potentially compromised until you have checked it. Rebuild from known-good backups when the signals are muddy. Alpine’s posture — assume compromise after a near miss — is the adult version of “we saw some crashes.”

Shrink exposure where you can. GitLab that must be public should sit behind strong authentication and network controls you already should have had. GitLab that does not need a public address should lose it. This desk will not publish sample expressions, overflow triggers, or proof-of-concept pipelines. Defenders need the version numbers and the KEV fact. Attackers already have the rest.

GitLab has had a rough patch calendar this year: two-factor bypasses, other maximum-severity regex and API issues, and repeated KEV attention. CVE-2026-97229 is the one with an active federal clock this week. Start there.

This briefing relies on public reporting by BleepingComputer and The Hacker News, and on CISA’s KEV listing. It does not include exploit procedures or proof-of-concept detail.