CISA Confirms Active Exploitation of Maximum-Severity GitLab Flaw
The US Cybersecurity and Infrastructure Security Agency has added a critical GitLab vulnerability to its Known Exploited Vulnerabilities catalog following active attacks in the wild.
Radwan AbdulhadiEditor and technology writer
CISA Issues Warning on Active GitLab Exploitation
Attackers have started exploiting a maximum-severity GitLab vulnerability patched earlier this month, according to the US Cybersecurity and Infrastructure Security Agency (CISA). The agency confirmed active exploitation of the flaw and added CVE-2026-97229 to its Known Exploited Vulnerabilities (KEV) Catalog, ordering federal agencies to secure their servers by Sunday as mandated by Binding Operational Directive (BOD) 26-04.
Although BOD 26-04 targets only federal agencies, the cybersecurity agency encouraged all security teams, including those in the private sector, to prioritize patching this vulnerability to protect their networks against ongoing attacks. Detailed coverage of the initial warning can be found via BleepingComputer.
Technical Breakdown of CVE-2026-97229
Tracked as CVE-2026-97229, this critical security flaw was discovered by a security researcher using the 'joaxcar' handle in the CI/CD Regular Expression Compiler, which parses, compiles, and evaluates regular expressions in pipeline configuration files.
The vulnerability stems from an integer overflow weakness and could let remote attackers run arbitrary code on targeted instances via a maliciously crafted regular expression in a CI/CD configuration, due to insufficient expression validation.
GitLab released official patch details explaining the exact scope of the issue. As it said in its release notes, GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.
Affected Versions and Immediate Remediation
GitLab addressed the security issue in GitLab Community Edition (CE) and Enterprise Edition (EE) versions 19.4.2, 19.3.5, and 19.2.8 and urged administrators to patch their servers immediately. The company has also released threat detections to support customers with self-managed instances after detecting exploitation attempts.
Internet threat watchdog Shadowserver tracks nearly 2,800 Internet-exposed GitLab Community Edition instances, though telemetry does not specify how many have already been secured against active attacks.
Broader Security Context and Recent GitLab Vulnerabilities
CVE-2026-97229 is the latest in a string of security issues GitLab has addressed since the start of the year. In January, it patched a high-severity two-factor authentication bypass that lets attackers who know the target's account ID circumvent two-factor authentication.
Earlier this month, it also fixed another maximum-severity vulnerability in the repository commits API and addressed separate regular expression compiler flaws, demonstrating a concerted effort by the maintainers to harden pipeline configurations and API endpoints.
Reporting was originally curated by journalists including Sergiu Gatlan, highlighting the rapid escalation of exploits targeting developer platforms and CI/CD pipelines.
Platform Scale and Industry Implications
GitLab's DevSecOps platform is utilized extensively across enterprise environments, serving over 50% of Fortune 100 companies and supporting more than 70 million registered users worldwide. Because CI/CD infrastructure holds deep access to source code repositories, deployment credentials, and internal build systems, remote code execution flaws present severe enterprise risk.
Security analysts emphasize that maintaining proactive patch management cycles for all self-hosted and cloud-connected instances remains essential for preventing automated compromise and lateral movement across corporate networks.
Sources
- BleepingComputerCISA says max severity GitLab flaw now exploited in the wild
Continue chronologically
Related stories
GitLab Warns of Max Severity Code Execution Flaw
GitLab has released urgent security patches for a maximum-severity integer overflow vulnerability in its Regular Expression Compiler engine.
Max-Severity GitLab Flaw Exploited Against Alpine Linux
A max-severity code execution vulnerability in GitLab was targeted in an attack against Alpine Linux's instance just one week after disclosure.
CISA Warns Ransomware Gangs Are Exploiting TeamCity Flaw
CISA alerts federal agencies that ransomware gangs are now actively exploiting a critical JetBrains TeamCity authentication bypass vulnerability.
CISA Warns Admins to Immediately Fix Ivanti Flaw
CISA urges security teams to immediately patch a high-severity Ivanti Connect Secure zero-day flaw actively exploited in recent cyber attacks.
