Attackers have started exploiting a maximum-severity GitLab vulnerability patched earlier this month, according to the US Cybersecurity and Infrastructure Security Agency (CISA).
Tracked as CVE-2026-97229, this critical security flaw was discovered by a security researcher using the ‘joaxcar‘ handle in the CI/CD Regular Expression Compiler, which parses, compiles, and evaluates regular expressions in pipeline configuration files.
CVE-2026-97229 stems from an integer overflow weakness and could let remote attackers run arbitrary code on targeted instances via a maliciously crafted regular expression in a CI/CD configuration, due to insufficient expression validation.
“GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation,” it said.
GitLab addressed the security issue in GitLab Community Edition (CE) and Enterprise Edition (EE) versions 19.4.2, 19.3.5, and 19.2.8 and urged admins to patch their servers immediately.
The company has also released threat detections to support customers with self-managed instances after detecting exploitation attempts.
On Thursday, the US Cybersecurity and Infrastructure Security Agency (CISA) confirmed active exploitation and added CVE-2026-97229 to its Known Exploited Vulnerabilities (KEV) Catalog. CISA also ordered federal agencies to secure their servers by Sunday, as mandated by Binding Operational Directive (BOD) 26-04.
Although BOD 26-04 targets only federal agencies, the cybersecurity agency encouraged all security teams, including those in the private sector, to prioritize patching this flaw to protect their networks against ongoing attacks.
Internet threat watchdog Shadowserver tracks nearly 2,800 Internet-exposed GitLab Community Edition instances, but it doesn’t say how many have already been secured against attacks.
CVE-2026-97229 is the latest in a string of security issues GitLab has addressed since the start of the year. In January, it patched a high-severity two-factor authentication bypass (CVE-2026-0723) that lets attackers who know the target’s account ID circumvent two-factor authentication.
Earlier this month, it also fixed a maximum-severity Regular Expression Compiler flaw (CVE-2026-110264) that could let remote attackers run arbitrary code on targeted instances.
Almost two weeks later, GitLab addressed another maximum-severity vulnerability (CVE-2026-85706) in the repository commits API that can be abused to read sensitive data, such as credentials and other secrets, from vulnerable servers.
One day later, CISA added CVE-2026-85706 to its list of actively exploited flaws after cybersecurity firm watchTowr reported that attackers had already begun scanning the Internet for unpatched GitLab servers.
CISA has tagged six GitLab vulnerabilities as exploited in the wild since November 2021, including two (tracked as CVE-2021-22175 and CVE-2021-39935) in February this year.
GitLab’s DevSecOps platform is used by over 50% of Fortune 100 companies and has more than 70 million registered users worldwide.
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
