On October 12, 2026, GitLab released versions 19.4.2, 19.3.5, and 19.2.8 to address CVE-2026-97229, a critical integer overflow vulnerability in its CI/CD regex handling. This flaw, reported by a user on HackerOne, has been assigned a CVSS score of 10.0 and could allow unauthenticated users to execute arbitrary code. GitLab has confirmed that all deployment types are affected unless specified otherwise.
Middle East Relevance
While the source does not establish a direct incident or deployment in the UAE or broader Middle East, organizations using GitLab’s CI/CD tools in the region should be aware of this vulnerability. The potential for exploitation underscores the need for vigilance among local users of GitLab products.
Key Facts
- GitLab versions 19.2 to 19.4.1 are vulnerable to CVE-2026-97229.
- The vulnerability allows for arbitrary code execution by unauthenticated users.
- GitLab.com was patched prior to the public disclosure of the vulnerability.
- Dedicated customers do not need to take action as their instances have been updated.
Technical Context
CVE-2026-97229 arises from an integer overflow in GitLab’s CI/CD regex handling, specifically during the evaluation of regular expressions in CI configurations. The vulnerability allows an attacker to craft a malicious CI configuration that, when processed, can lead to arbitrary code execution. The flaw is particularly concerning because it can be triggered through unauthenticated API calls to the CI lint endpoint, which evaluates CI configurations without requiring user authentication.
Risk and Decision
Organizations using affected versions of GitLab should prioritize upgrading to the patched versions to mitigate the risk of exploitation. The potential for unauthorized code execution poses significant operational and security risks, making immediate action necessary for those managing GitLab instances.
Defensive Guidance
Self-managed GitLab customers are advised to upgrade to versions 19.4.2, 19.3.5, or 19.2.8. As a temporary measure, organizations should restrict access to public projects that allow unauthenticated users to write CI configurations or block access to the CI lint API endpoint. Monitoring for unusual activity related to CI configurations is also recommended.
Source and evidence
This report is based on an advisory from Rapid7, detailing the vulnerability and its implications as of October 12, 2026. For further information, refer to the original advisory on Rapid7’s website.
CWME will continue tracking regional implications as more verified information becomes available.
Follow Cyber Warriors Middle East for further cybersecurity resources, advisories and technical guidance.
