CVE-2026-97229: GitLab CVSS 10.0 Vulnerability Has Been Exploited, Update Alone Is Not Enough

CVE-2026-97229 is a remote code execution (RCE) vulnerability in GitLab Community Edition and Enterprise Edition with a maximum CVSS score of 10.0, and since October 29 2026 has been included in CISA's Known Exploited Vulnerabilities (KEV) catalog because it has been used to attack. Attackers can run code on self-managed GitLab servers without logging in, simply with a specially designed CI/CD configuration.

What makes this case different: the bug is not in the GitLab code, but in Ruby's built-in regex engine. Servers already running a "secure" version of GitLab can still be vulnerable if the underlying Ruby hasn't been patched. This article discusses how the vulnerability works, affected versions, how to check your server, and steps to take today.

CVE-2026-97229 Summary

How can a regex gap become RCE?

Regex engines compile each pattern into a small bytecode program. According to Rapid7's analysis, Onigmo miscalculated the size of the program due to an integer overflow. CI/CD configurations that contain repository paths with certain UTF-8 characters force the regex to be recompiled after validation checks pass. The resulting recompile contained invalid instructions that broke the control flow in the Ruby process that GitLab uses to read the configuration.

Memory corruption in the interpreter processing input from an attacker can almost always be redirected to code execution. On paper, the chain is simple:

1. The attacker registers an account on the instance that opens self-registration.
2. The attacker creates a public project and commits .gitlab-ci.yml malicious commit.
3. GitLab processes the file, the regex is recompiled, and the attacker's code runs on the server.

Therefore instances that allow open registration and creation of public projects are the most risky, as the entire chain can be run without any credentials.

Which versions of GitLab are affected?

If you're still on a branch older than 19.2, that version is outside the fix support window. Plan jumps to branches that are still supported, not just point releases.

When Censys released the advisory on October 13, they counted approximately 25,766 vulnerable hosts exposed to the internet. Today's numbers are likely down, but they still show the scale: tens of thousands of build servers storing source code, CI variables, and deployment credentials.

What's going on in Alpine Linux?

The incident at Alpine Linux's public GitLab is the clearest example so far, and is the basis for CISA adding this loophole to KEV.

Of the eight crashes, four of them passed the initial crash stage and only failed at the next stage. The attacker also downloaded Alpine's GitLab container image, suggesting an exploit was being set for the build. Alpine found no evidence of a successful attack, but because it couldn't be sure, the team was treating the server as compromised. Their examination concluded the aports repository, packages, and the October 21 release were not modified.

The most important lesson: Alpine was already running 19.3.6, a version that is on paper safe, and remained vulnerable because the Ruby in its image had not been patched.

Why isn't just updating GitLab enough?

Improvements from GitLab are in the form of patches on the Ruby interpreter bundled in the official package and container image. This means your security status depends on how GitLab is installed:

How to check which version of Ruby is actually running

Don't just trust the image tag or GitLab version on admin pages. Check the running runtime:

# Instalasi Omnibus: versi Ruby bawaan
/opt/gitlab/embedded/bin/ruby -v

# Ringkasan versi GitLab dan Ruby
sudo gitlab-rake gitlab:env:info

# Container: cek runtime di dalam container yang sedang berjalan
docker exec <nama-container> ruby -v

One note: vendors can include fix backports without changing the upstream version number. So a Ruby number below 3.3.13 on the official GitLab package doesn't necessarily mean it's vulnerable. Check with the GitLab release notes for the package you are using.

Steps that need to be taken today

1. Inventory. Data on all self-managed GitLab instances, including test servers and the often forgotten host runner.
2. Upgrade to the latest point release on your branch, not just the minimum version. Media reports say there is a second regex flaw, CVE-2026-110264, also CVSS 10.0, with fixes in 19.2.9, 19.3.6, and 19.4.3. Verify the details in the official GitLab advisory.
3. Verify Ruby with the above command. The correct version of GitLab does not guarantee that Ruby is correct.
4. Limit exposure temporarily. Turn off self-registration, limit anonymous access to public projects, prevent untrusted users from creating or writing to public projects, and if you can't upgrade yet, limit login access to the web interface. This step helps but does not replace the patch.
5. Look for traces of intrusion. Note repeated worker crashes while processing CI, unexpected child processes of GitLab workers, suspicious new accounts since October 12, and unrecognized SSH keys.
6. Rotate secrets if your instance is exposed to the internet and hasn't been patched after October 12: CI/CD variables, token runner, deploy key, and personal access token. Follow the Alpine method, which is to assume the server has been compromised until proven otherwise.

Another crack entered KEV on the same day

Along with GitLab, CISA also added CVE-2026-76418 (CVSS 8.6) in Cisco Secure Firewall ASA and FTD. This NULL pointer dereference vulnerability allows an unauthenticated remote attacker to reboot the device itself, resulting in a disruption of service (DoS). Cisco said it had seen active exploitation since early October. If you manage Cisco firewalls, put these updates on the same schedule.

For teams managing PHP servers, also be aware of PHP2Shell (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2), two unauthenticated RCE vulnerabilities that hit KEV on October 26. The fix is ​​in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

Frequently asked questions

Are GitLab.com users affected?

No. GitLab.com was already patched before the loophole was announced. The risk exists in CE and EE self-managed installations.

My instance does not open public registration. Is it safe?

The risk is lower, but not zero. Internal users or accounts that have been compromised can still commit malicious CI configurations. Patches remain mandatory.

Who does the November 1 deadline apply to?

The deadline is mandatory for United States federal civilian agencies. Companies in Indonesia are not tied down, but the entry of a loophole into KEV means there is already a real attack, so treat it as the highest priority.

Is there a public exploit yet?

Rapid7 released a technical analysis and successfully reproduced RCE in GitLab 19.4.1 CE on October 13, and Censys noted a public proof of concept. With available PoCs, the time between patch and mass attack is usually short.

What if I use another Ruby application besides GitLab?

The flaw is in Onigmo, so other Ruby applications that compile regexes from untrusted input are also worth checking. Upgrading Ruby to 3.3.13, 3.4.12, or 4.0.9 and above is a safe step for all Ruby applications.

Source

• CISA Adds Actively Exploited GitLab RCE and Cisco Firewall DoS Flaws to KEV, The Hacker News
• GitLab CVSS 10.0 Joins CISA KEV, Ruby Fix Needed, Tech Insider
• CVE-2026-97229: Critical Unauthenticated RCE in GitLab, Rapid7
• Advisory CVE-2026-97229, Censys
• CVE-2026-109618 and CVE-2026-109619 (PHP2Shell), Rapid7
• Known Exploited Vulnerabilities Catalog, CISA