Self-managed GitLab servers need yesterday’s critical patch. Upgrade before someone runs code on yours

If your developers push code to a GitLab server your company runs itself, that server needs an upgrade this morning. GitLab released a critical patch on October 12 for a bug rated 10.0 that, in GitLab’s words, could let “an unauthenticated user to execute arbitrary code on the GitLab server.”

GitLab.com is already patched and GitLab Dedicated customers have nothing to do. Self-managed Community and Enterprise Edition servers are on their own.

Your GitLab server holds the source code, the CI secrets and the deploy keys. A no-login bug on that box deserves today’s change window.

The 5-Minute Cyber Brief

Don’t Miss the Policy Changes That Affect Security Decisions

Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.

Email addressSend me tomorrow’s brief

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

GitLab ships a 10.0 fix for its CI/CD regex engine

The critical fix is for an integer overflow in the CI/CD regular expression compiler. GitLab says a specially crafted regular expression in a CI/CD configuration could have allowed an unauthenticated user to run code on the server, “due to insufficient regular expression validation.” It is scored 10.0 under CVSS 3.1, with a changed scope. A researcher using the handle joaxcar reported it through GitLab’s HackerOne program.

The release carries 24 security fixes in total:

• 1 critical: the CI/CD regex compiler bug above.
• 5 high, including a stored cross-site scripting bug in syntax highlighting (8.7), a downstream pipeline flaw that let a Developer run pipelines on protected branches (8.5), and a cache-poisoning bug in raw file access that could expose protected CI variables (8.2).
• 18 medium and low, several of them GraphQL authorization gaps that let users with no login read confidential notes or work items on some projects.

GitLab’s post does not say the critical bug has been exploited. The critical flaw is tracked as CVE-2026-97229, and the public CVE.org record was published early Tuesday.

Every self-managed GitLab on 19.2, 19.3 or 19.4

The critical bug affects GitLab CE/EE 19.2 before 19.2.8, 19.3 before 19.3.5 and 19.4 before 19.4.2. Several of the other fixes reach much further back. The cache-poisoning bug affects all versions before 19.2.8, and the Pages logging bug goes back to 12.0.

Watch the 19.3 line. GitLab first shipped 19.3.4, found that it broke merge request pages when the Ona integration is enabled, and replaced it with 19.3.5. If someone on your team grabbed the first package on Monday, check that the box is on 19.3.5.

Upgrade to 19.4.2, 19.3.5 or 19.2.8 today

• Find the version: in the Admin area, or run sudo gitlab-rake gitlab:env:info on a Linux package install.
• Upgrade to 19.4.2, 19.3.5 or 19.2.8, depending on your branch. Follow GitLab’s upgrade path if you are more than one minor version behind.
• If you run an older branch that has no fix in this release, plan the move to a supported branch. Several of the high and medium bugs reach back to 17.x and 18.x.
• After the upgrade, rotate CI/CD variables and runner tokens on any instance that was reachable from the internet before the patch.

Details

• Release: GitLab Critical Patch Release 19.4.2, 19.3.5, 19.2.8, published October 12, 2026.
• Critical bug: integer overflow in the CI/CD regular expression compiler, unauthenticated code execution, CVSS 3.1 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Tracked as CVE-2026-97229 (now published in CVE.org).
• Affected: GitLab CE/EE 19.2 before 19.2.8, 19.3 before 19.3.5, 19.4 before 19.4.2.
• Other fixes: 5 high, 14 medium, 4 low. Highs include syntax-highlighting XSS (8.7), downstream pipeline authorization (8.5), raw file cache poisoning (8.2), scheduled pipeline execution policy (7.7) and prompt injection in GitLab Duo Agent Platform (7.3).
• Not affected: GitLab.com (already patched); GitLab Dedicated (no action).

Hunt / verify

• Recent changes to .gitlab-ci.yml files with unusual or very long regular expressions, especially from accounts that rarely touch CI.
• Unexpected child processes started by the GitLab application services (Puma, Sidekiq) or outbound connections from the GitLab host to addresses it does not normally contact.
• New personal access tokens, deploy keys or admin accounts created since early October.

Slack paste: GitLab critical patch (Oct 12): CVSS 10.0 no-login code execution via CI/CD regex on self-managed CE/EE 19.2–19.4. Action: upgrade to 19.4.2 / 19.3.5 (not 19.3.4) / 19.2.8 today, then rotate CI variables and runner tokens on internet-facing instances.

Sources

• GitLab: Critical Patch Release 19.4.2, 19.3.5, 19.2.8 (October 12, 2026)
• GitLab: Upgrade GitLab (upgrade paths)
• CVE-2026-97229 (CVE.org)

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].