GitLab CVE-2026-97229: CVSS 10 CI/CD RCE Exploited, Patch Within 24 Hours

The CVE-2026-97229 exploit path begins at GitLab's publicly exposed CI/CD lint API and ends with arbitrary code execution on the server. The attack requires no credentials, session tokens, or prior knowledge of the GitLab configuration.

GitLab exposes an HTTP endpoint at /api/v4/ci/lint that accepts POST requests containing .gitlab-ci.yml YAML for syntax and rule validation. This endpoint is designed to help developers check pipeline configurations before committing them. On all self-managed GitLab installations, this endpoint responds to unauthenticated requests by default -- it was designed for convenience in developer tooling workflows.

The CI/CD regex compiler processes rules:if and only:variables expressions containing regular expression patterns. These patterns use a quantifier field that stores repeat counts as a fixed-width integer. When an attacker supplies a crafted regex with a quantifier value near the maximum for the integer type, the compiler adds a constant offset during automaton construction. The addition overflows the integer's capacity, wrapping the value to a small or negative number. The compiler then calls malloc() with this wrapped value, allocating a buffer far smaller than the actual automaton requires. Subsequent write operations overwrite memory beyond the buffer's boundary, corrupting adjacent heap structures.

The severity of the outcome depends on heap layout. In the best case for defenders, the process crashes with a segmentation fault. In the worst case -- which researchers have confirmed -- the overwritten region contains a heap metadata structure that can be shaped into a code-execution primitive. Successful exploitation yields a shell running as the gitlab-www user, with full read access to the GitLab database, repository storage, and CI/CD secrets.

The attack path has no prerequisite actions: one POST request to /api/v4/ci/lint is sufficient. No GitLab account, API token, or legitimate pipeline context is needed. Any internet-accessible GitLab instance is a target.

An important supply chain parallel: the MIASMA worm targeting GitHub developer repos and IDE extensions demonstrates how attackers are systematically targeting developer tooling -- GitLab CI/CD compromise follows the same pattern at the infrastructure layer.

CVE-2026-97229 affects GitLab Community Edition and Enterprise Edition across three active release branches. GitLab patched all three branches simultaneously on October 12, 2026. The table below shows the affected and fixed versions.

GitLab 19.1 and older are outside the active support window. Organizations still running 19.1.x or older must upgrade to a supported branch (19.2.8+) rather than expect a backport. GitLab does not indicate that the flaw is limited to 19.x -- the integer overflow may affect older versions through different code paths, but those branches are unsupported.

Note on 19.3.4 vs 19.3.5: some secondary sources list the 19.3 fix as 19.3.5. This discrepancy may reflect a follow-on patch for a separate bug in 19.3.4 affecting merge request pages with the Ona integration enabled. Check the GitLab release notes for your branch before selecting a target version.

CISA's October 29 KEV addition confirms that attackers began exploiting CVE-2026-97229 against unpatched organizations within the 17-day window between GitLab's disclosure (October 12) and the KEV listing. The timeline below shows the key events.

GitLab disclosed CVE-2026-97229 alongside the patch release on October 12, 2026, following a responsible disclosure process through its HackerOne bug bounty program. The researcher assigned the handle 'joaxcar' reported the flaw. GitLab's disclosure did not indicate in-the-wild exploitation at the time of release -- a pattern consistent with attackers reverse-engineering the patch to develop an exploit after public disclosure rather than before it.

The 17-day exploitation window aligns with the typical attacker timeline for CVE exploitation after a critical patch is released: patch analysis to working exploit generally takes between 48 hours and three weeks for a critical-rated flaw with a clear primitive (integer overflow into heap corruption). The CISA KEV confirmation on October 29 indicates that exploit tooling matured and was deployed against production targets within that window.

No specific threat actor attribution or confirmed victim disclosure has been made public as of October 30, 2026. CISA's KEV entry does not name the exploitation actor, and GitLab's advisory notes that the exploitation evidence was provided by external researchers. The absence of attribution does not reduce urgency -- KEV confirmation is the definitive signal for enterprise patch prioritization.

Key defensive implication: organizations that treated the October 12 GitLab release as routine maintenance rather than an emergency patch may have been compromised during the window. Any organization running 19.1.0 through 19.4.1 that has not upgraded should assume potential compromise and perform forensic triage alongside upgrading.

The Storm-0940 ARTEX AI supply chain attack on ConnectWise M365 demonstrates that sophisticated actors are specifically targeting developer and DevOps infrastructure -- GitLab is a high-value target in the same category.

No confirmed attacker IP addresses, domains, or file hashes have been publicly released for CVE-2026-97229 exploitation as of October 30, 2026. The indicators below are behavioral -- derived from the known exploit path and post-exploitation patterns typical of web process RCE on GitLab servers. Use these for hunting in SIEM and EDR data.

Review GitLab production logs at /var/log/gitlab/gitlab-rails/production.log for POST requests to /api/v4/ci/lint without authentication headers. Legitimate external uses of the lint API include GitLab CI/CD editor and developer tooling -- baseline this traffic before treating all unauthenticated lint requests as malicious. Anomalous indicators include: requests from unfamiliar source IPs, abnormally large request bodies, or requests at unusual hours relative to your developer workforce.

Post-exploitation artifacts: watch for the gitlab-www user creating files in locations it does not normally write, adding SSH keys to /var/opt/gitlab/.ssh/authorized_keys or /home/git/.ssh/authorized_keys, or spawning processes outside the normal GitLab process tree (puma, sidekiq, gitlab-workhorse). Any outbound network connection initiated by a GitLab Ruby worker process to a non-GitLab destination warrants immediate investigation.

These two rules cover the primary exploitation indicator (unauthenticated CI/CD lint API access from external IPs) and post-exploitation detection (GitLab web process spawning a shell). Both carry experimental status; validate against your environment's log format and GitLab deployment topology before enabling automatic blocking.

These steps address both the immediate upgrade requirement and interim mitigations for instances that cannot be upgraded within the next four hours. Mitigations without upgrading reduce exploitation risk but do not eliminate the vulnerability.

CVE-2026-97229 is not a routine web application CVE. GitLab's CI/CD platform sits at the intersection of source code, secrets, and production deployments for the organizations that run it. A single successful exploit produces an attacker foothold with access to every repository, every pipeline variable, and every deployment credential stored on that GitLab instance.

The CI/CD pipeline trust model amplifies the blast radius. In most organizations, GitLab CI/CD pipeline jobs run with elevated permissions in staging and production environments -- they deploy code, call APIs, push to registries, and access cloud infrastructure. An attacker who compromises the GitLab server process can modify pipeline YAML files to inject malicious build steps, creating a supply chain attack against every downstream environment that those pipelines deploy to. This is not theoretical: the Storm-0940 ARTEX attack on ConnectWise M365 used a similar supply chain positioning to gain multi-tenant access across downstream organizations.

The 17-day exploitation window highlights an ongoing patch prioritization failure in many organizations. GitLab released the fix with a clear CVSS 10.0 rating on October 12. Organizations that process vulnerability disclosures on a weekly or bi-weekly schedule -- rather than triaging CVSS 9.5+ unauthenticated RCE disclosures as emergency patches -- remained exposed for nearly three weeks. The CISA KEV confirmation on October 29 confirms that attackers were faster than the standard enterprise patch cadence.

GitLab self-managed deployments are increasingly common in regulated industries and defense supply chains precisely because they keep source code on-premises. That positioning also means they are frequently internet-facing without the additional WAF and network controls applied to more visible services. Any organization with an internet-facing self-managed GitLab instance running 19.1.0 through 19.4.1 should treat today as day zero for this patch.