SECURITY_THREAT_PULSE
LIVE
LAST UPDATED
FIRST SEEN
13 SOURCES ON THIS EVENT
▲ ACT NOWTODAYCVE-2026-97229 · CVSS 10.0

GitLab Community Edition and Enterprise Edition: attackers can run their own code

AFFECTSGitLab Community Edition and Enterprise EditionGitLab

OFFICIAL NAME: GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability

WHAT IT IS · DEVELOPER TOOLSIt holds source code and the keys used to build and ship software.

DO THIS FIRSTPatch it. If it faced the internet, change the keys and passwords stored in it. Not sure if you use it? Send this page to your IT provider or security lead and ask.

TECHNICAL SUMMARY GitLab Community Edition and Enterprise Edition contain a integer overflow or wraparound vulnerability that could allow an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.

WHY THIS VERDICT Attacks are confirmed. The vulnerability is 29 days old, so many systems are likely still unpatched. Ready-made attack tools are public. The severity score is critical (10.0). The exploit prediction score is 65%.

WHY IT RANKS HERE Exploitation is confirmed by an authoritative source. Ready-made attack tools are public. The confirmation is 13 days old.

HIGHEST CONFIRMED RUNG
EXPLOITED
CISA KEV
LISTED
EXPLOIT CODE
READY TO USE
// EVIDENCE LADDER

How far has it climbed?

CONFIRMED
REPORTED
NO EVIDENCE

  1. 01 TALK

    ■ CONFIRMED
    NEWEST EVIDENCE · 4 INDEPENDENT SOURCES

    CVE-2026-97229 discussed publicly (CIRCL sighting). CVE-2026-97229 discussed publicly (CIRCL sighting).

  2. 02 EXPOSED

    □ NOT TRACKED YET
    NO SOURCE FOR THIS STEP YET

    We have no source that counts exposed systems yet. Internet scan data needs a partnership we do not have. No evidence here does not mean nothing is exposed.

  3. 03 TRIED

    ■ CONFIRMED
    NEWEST EVIDENCE · 3 INDEPENDENT SOURCES

    Attacks that worked are confirmed (step 4), so attempts count as confirmed too.

  4. 04 EXPLOITED

    ■ CONFIRMED
    NEWEST EVIDENCE · 3 INDEPENDENT SOURCES

    Exploitation of CVE-2026-97229 reported (CIRCL sighting). Exploitation of CVE-2026-97229 reported (CIRCL sighting).

  5. 05 DAMAGE

    □ NOT TRACKED YET
    NO SOURCE FOR THIS STEP YET

    Breach notices and filings rarely name the flaw that was used, so we cannot link them to this event yet. No evidence here does not mean no harm.

// THE CLOCK

When each thing happened

  1. DISCLOSED
    CVE-2026-97229 published
  2. EXPLOIT CODE PUBLIC
    CIRCL Vulnerability-Lookup sightings
  3. FIRST ATTACK REPORT
    CISA Known Exploited Vulnerabilities
  4. CISA KEV LISTING
    CISA KEV listing
  5. US FEDERAL DEADLINE
    CISA deadline for US federal agencies
Attacks were reported 16 days after disclosure. CISA listed it 16 days after disclosure.

THE FIX

CISA's instruction: apply the vendor's fix, or stop using the product if no fix exists. The deadline CISA set for US federal agencies, Nov 1, 2026, has passed. It is a US government deadline; use it as a guide.

// ASK YOUR TEAM

Questions to ask this week

// TIMELINE · PACIFIC TIME

How it unfolded

  1. OCT 11, 2026
    Metasploit exploit module: GitLab CI/CD RegExp Integer Overflow Remote Code Execution
  2. Attack activity. OCT 12, 2026
    CISA Vulnrichment marks CVE-2026-97229 as actively exploited
  3. OCT 13, 2026
    5 public GitHub repositories claim a proof of concept for CVE-2026-97229
  4. Attack activity. OCT 28, 2026
    GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability
  5. OCT 29, 2026
    Attacker Tried to Exploit Alpine Linux’s GitLab via CVSS 10.0 Flaw Its Ruby Left Open
  6. OCT 29, 2026
    CVE-2026-97229 discussed publicly (CIRCL sighting) (86 reports, latest NOV 10)
  7. OCT 29, 2026
    GitLab security advisory (AV26-1028) - Update 1
  8. OCT 30, 2026
    CISA Adds Actively Exploited GitLab RCE and Cisco Firewall DoS Flaws to KEV
  9. OCT 30, 2026
    Max-Severity GitLab Vulnerability Exploited Against Alpine Linux
  10. Attack activity. OCT 30, 2026
    Exploitation of CVE-2026-97229 reported (CIRCL sighting) (2 reports, latest NOV 2)
  11. NOV 2, 2026
    Vulnerability CVE-2026-97229 confirmed by a researcher (CIRCL sighting)
  12. NOV 3, 2026
    Public proof of concept for CVE-2026-97229 (CIRCL sighting) (2 reports, latest NOV 6)

SOURCES

  1. [1] nuclei-templates: Nuclei scan template: GitLab CE/EE < 19.2.8 / 19.3.5 / 19.4.2 - Unauthenticated RCE via Onigmo Integer Overflow, NOV 2
  2. [2] CIRCL Vulnerability-Lookup sightings: CVE-2026-97229 discussed publicly (CIRCL sighting), NOV 10
  3. [3] CIRCL Vulnerability-Lookup sightings: Public proof of concept for CVE-2026-97229 (CIRCL sighting), NOV 6
  4. [4] CIRCL Vulnerability-Lookup sightings: Vulnerability CVE-2026-97229 confirmed by a researcher (CIRCL sighting), NOV 2
  5. [5] SecurityWeek: Max-Severity GitLab Vulnerability Exploited Against Alpine Linux, OCT 30
  6. [6] The Hacker News: CISA Adds Actively Exploited GitLab RCE and Cisco Firewall DoS Flaws to KEV, OCT 30
  7. [7] Canadian Centre for Cyber Security: GitLab security advisory (AV26-1028) - Update 1, OCT 29
  8. [8] The Hacker News: Attacker Tried to Exploit Alpine Linux’s GitLab via CVSS 10.0 Flaw Its Ruby Left Open, OCT 29
  9. [9] CISA Known Exploited Vulnerabilities: GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability, OCT 28
  10. [10] PoC-in-GitHub: 5 public GitHub repositories claim a proof of concept for CVE-2026-97229, OCT 13
  11. [11] CVE List V5 and CISA Vulnrichment: CISA Vulnrichment marks CVE-2026-97229 as actively exploited, OCT 12
  12. [12] Metasploit module metadata: Metasploit exploit module: GitLab CI/CD RegExp Integer Overflow Remote Code Execution, OCT 11
  13. [13] CIRCL Vulnerability-Lookup sightings: 88 more reports