GitLab patches critical CVSS 10 unauthenticated RCE flaw in CI/CD

On October 12, GitLab released security updates versions 19.4.2, 19.3.5, and 19.2.8 for both Community Edition and Enterprise Edition. The company fixed 24 vulnerabilities, headlined by a critical flaw that allowed unauthenticated remote code execution on self-hosted instances under certain conditions.

Tracked as CVE-2026-97229 with a maximum CVSS score of 10.0, the core issue stems from insufficient regular expression validation in CI/CD configurations. An integer overflow error allowed attackers to supply a maliciously crafted regular expression that executed arbitrary code on the server without requiring any user authentication.

The flaw affected versions in the 19.2 branch prior to 19.2.8, the 19.3 branch prior to 19.3.5, and the 19.4 branch prior to 19.4.2. Self-hosted administrators must update immediately, though they should account for database migrations bundled into the packages. Single-server instances will experience temporary downtime during these migrations, whereas multi-server deployments support zero-downtime procedures.

Alongside the headline flaw, the updates patch five other high-severity issues. These include an XSS vulnerability in syntax highlighting (CVE-2026-92883), an authorization bypass allowing developers to run pipelines on protected branches (CVE-2026-16301), and a cache-poisoning vector in repository file retrieval that exposed protected environment variables (CVE-2026-14814).

Cloud-hosted instances on GitLab.com have already been updated, and GitLab Dedicated users require no further action. Administrators are advised to review the official release notes for specific migration guidelines.

Source: habr