What a CVSS 10.0 GitLab CI/CD regex flaw means for self-managed installs
GitLab released fixes on October 12, 2026, for a CVSS 10.0 flaw in its CI/CD regex compiler, affecting self-managed installations on older versions.
GitLab released patch versions on October 12, 2026, fixing a critical flaw in the CI/CD regular expression compiler. The flaw is tracked as CVE-2026-97229 and carries a CVSS score of 10.0. It is one of 24 security fixes in the same release. The flaw is rated critical, and GitLab says self-managed installations should be upgraded immediately.
As of October 13, 2026, the GitLab release page does not report any exploitation in the wild. A TechStartups roundup published the same day also covered the release, citing BleepingComputer, and it gives a different fixed version for one branch. The details below rest on GitLab's own advisory and patch feed, with the roundup noted where it differs.
What the flaw allows, and under what conditions
GitLab's advisory says it has remediated an issue that could have allowed an unauthenticated user to execute arbitrary code on the GitLab server. The route is a specially crafted regular expression placed in a CI/CD configuration. The advisory says this was possible under certain conditions, but it does not describe those conditions beyond the attacker being unauthenticated.
The page names the flaw an integer overflow in its table. Its description attributes the cause to insufficient regular expression validation. This article reports both descriptions as the page gives them.
The advisory lists the critical CVE as affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. TechStartups says the flaw was reported through GitLab's HackerOne vulnerability disclosure program.
GitLab's patch feed lists the October 12 release first, ahead of four earlier entries dated October 2, September 23 (two entries) and September 10, 2026.
Which versions are affected and what each deployment type needs
Affected releases are 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. The fixed versions apply to both the Community and Enterprise editions. The impacted-version lines for 23 of the 24 CVEs end at 19.2.8, 19.3.5 and 19.4.2; CVE-2026-84284 lists all 19.3 versions as affected instead.
GitLab says GitLab.com already runs the patched version and that GitLab Dedicated customers need no action. Self-managed installations are the deployment type the page directs to upgrade. The advisory adds that, unless a deployment type is specified, all types are considered affected, including Omnibus, source and Helm chart installations.
The 19.3 branch is where the sources differ. TechStartups lists 19.3.4 as the fixed version. The advisory says 19.3.4 had a bug affecting merge request pages when the Ona integration was enabled, and that the fix is in 19.3.5. GitLab's patch feed also names 19.3.5, so this article uses that version.
The other 23 fixes in the same release
The release covers 24 CVEs in total. GitLab's breakdown lists one critical, five high, 14 medium and four low items. Six of the 24 apply only to the Enterprise edition, according to the advisory table.
Among the high-severity items, CVE-2026-92883 is a cross-site scripting issue in syntax highlighting and is rated 8.7. CVE-2026-16301 covers improper authorization in downstream pipeline creation and is rated 8.5. CVE-2026-14814, rated 8.2, concerns a permissive regular expression in repository file access. CVE-2026-81839, rated 7.7, covers incorrect authorization in scheduled pipeline execution policies and applies only to the Enterprise edition.
A high-severity item rated 7.3, CVE-2026-96893, covers LLM prompt input neutralization in GitLab Duo Agent Platform. According to the page, it applies only to the Enterprise edition.
Medium and low items cover authorization problems and sensitive data exposure. CVE-2026-101168, rated 6.2, is a sensitive information exposure issue in GitLab Pages logs. CVE-2026-9268, rated 2.7, concerns access control for CI/CD deployment rollback settings and is Enterprise-only.
“The flaw is rated critical, and GitLab says self-managed installations should be upgraded immediately.”
Upgrade steps and what the sources leave open
The patch includes database migrations. Single-node instances should expect downtime, because migrations must finish before GitLab starts. Multi-node instances can use zero-downtime upgrade procedures. Version 19.3.5 also includes post-deploy migrations that can run after the upgrade.
GitLab points readers to its guides on zero-downtime and standard upgrades, and says GitLab Runner should be updated separately under its own documentation. The advisory says issue details for these fixes become public on the GitLab issue tracker 90 days after release, which would be January 10, 2027.
The sources leave exploitation open. GitLab's advisory does not state whether any of these vulnerabilities are being exploited in the wild. TechStartups says the reporting it reviewed found no confirmed widespread exploitation of this specific flaw, but adds that attackers, including ransomware operators, have exploited earlier GitLab security flaws. It attributes that item to BleepingComputer.
