GitLab CVE-2026-97229 exploited: CISA adds it to the KEV

📌 Later developments: GitLab CVE-2026-97229: Alpine attacked, Ruby must be updated too (October 29, 2026)

On 29 October 2026 the US CISA added CVE-2026-97229 in GitLab Community Edition (CE) and Enterprise Edition (EE) to its Known Exploited Vulnerabilities (KEV) catalog, the list of vulnerabilities exploited in real-world attacks. It is the CVSS 10 vulnerability in the CI/CD regular expression compiler that ARX News covered on 12 October, when GitLab fixed it in versions 19.4.2, 19.3.5 and 19.2.8.

The picture has changed: in mid-October neither Rapid7 nor INCIBE-CERT reported attacks in progress. The new information in this article comes from a single source, the KEV catalog entry and the linked NVD record.

What CISA says

The KEV entry classifies the flaw as “Integer Overflow or Wraparound” and states:

• date added: 29 October 2026;
• due date: 1 November 2026, the deadline for US federal agencies to act, three days after the listing;
• known use in ransomware campaigns: “Unknown”;
• required action: apply mitigations according to the vendor’s instructions, in line with directive BOD 26-04 on prioritising security updates based on risk and with CISA’s “Forensics Triage Requirements”. If mitigations are unavailable, CISA says to discontinue use of the product, and it asks for each asset’s Internet exposure to be evaluated.

The entry does not describe the attacks: it does not say since when the vulnerability has been exploited, by whom or against which targets, and it lists no indicators of compromise.

Technical details from the NVD record

The NVD record, published on 13 October and updated on 29 October, is still “Undergoing Analysis”. It reports:

• description: under certain conditions, an unauthenticated user can execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation;
• weakness: CWE-190 (integer overflow or wraparound);
• CVSS 3.1: 10.0, vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, assigned by GitLab;
• affected versions: 19.2 before 19.2.8, 19.3 before 19.3.5, 19.4 before 19.4.2;
• references: GitLab’s 19.4.2 patch release notes, the issue in GitLab’s tracker and two restricted-access HackerOne reports.

The exploitation preconditions described by Rapid7, already covered in our mid-October article, remain the only public ones: committing a malicious .gitlab-ci.yml file to a public project, with a repository path containing UTF-8 characters; on instances that let users create public projects, an ordinary account is enough. CISA does not say whether the attacks follow this pattern. In MITRE ATT&CK terms it is still exploitation of a public-facing application (T1190).

October’s versions are no longer enough

Versions 19.4.2, 19.3.5 and 19.2.8 fix CVE-2026-97229, but according to CERT-EU’s 22 October advisory they are affected by CVE-2026-110264, another CVSS 10 vulnerability with unauthenticated code execution, which GitLab fixed on 21 October. For the branches listed in the NVD record, the versions that close both flaws are 19.2.9, 19.3.6, 19.4.3 and 19.5.1 or later.

As reported on 22 October, according to KISA only the 19.3, 19.4 and 19.5 branches have fixed versions for two other vulnerabilities in the same release (CVE-2026-15723 and CVE-2026-112212).

The NVD record does not list branches older than 19.2, and the sources do not say whether they are affected by CVE-2026-97229. For CVE-2026-110264, CERT-EU gives 18.11.13, 19.0.10 and 19.1.9 as the first unaffected versions.

Impact for European and Italian companies

The 1 November deadline applies to US federal agencies. For everyone else, the KEV listing means the vulnerability is no longer just theoretical.

The most exposed instances are self-managed ones reachable from the Internet, especially those with open registration or where users can create public projects, the condition identified by Rapid7. According to GitLab’s guidance reported in mid-October, GitLab.com already runs the fixed version and GitLab Dedicated customers do not need to take action. A GitLab server usually holds source code, release pipelines and credentials for integrations.

For organisations in scope of NIS2, what we wrote before still applies: vulnerability management, software supply chain security and, in the event of a significant incident, notification to the national CSIRT (in Italy, CSIRT Italia at ACN).

What to do right now

1. Inventory: identify all self-managed GitLab instances, with edition, version and Internet exposure, as CISA asks.
2. Update: bring each instance to at least 19.2.9, 19.3.6, 19.4.3 or 19.5.1, preferring the 19.3 branch or later, starting with Internet-facing instances. If you are on 19.2.8, 19.3.5 or 19.4.2, you are protected against CVE-2026-97229 but not against CVE-2026-110264.
3. Branches older than 19.2: the sources give no fix for CVE-2026-97229; move to one of the supported branches listed.
4. Compromise assessment: CISA points to its forensic triage requirements. Look for recent changes to .gitlab-ci.yml in public projects, especially by new or rarely used accounts, and for repository paths with non-ASCII characters. The detection rules GitLab published on 21 October concern CVE-2026-110264: the sources do not say whether they also detect CVE-2026-97229. No source lists indicators of compromise.
5. If you find suspicious activity: treat the server as exposed, rotate the secrets used by pipelines and integrations, and assess your notification obligations.

How ARXDOME helps

ARX Expose shows which services your company exposes to the Internet, which products are recognised on them and which have known vulnerabilities: it helps you find out whether a GitLab instance can be reached from outside. ARX Shield lists the open vulnerabilities on monitored machines. ARX Sentry collects logs and events from the servers where the agent is installed and checks file integrity in the chosen folders. With ARX Horizon you can look up vulnerability details from the portal.

Last updated: 29 October 2026