Over 1,000 GitLab servers still exposed to actively exploited RCE
CVE-2026-97229 (CVSS 10.0) allows unauthenticated remote code execution via a malicious regex in a CI/CD configuration; CISA confirms active exploitation. More than 1,000 servers remain exposed. Update to 19.2.8, 19.3.5 or 19.4.2.
What happened
A maximum-severity flaw (CVSS 10.0) in GitLab lets attackers run code on the server without authentication. CISA confirms active exploitation, and BleepingComputer reports more than 1,000 servers remain exposed. Alpine Linux's own GitLab server was attacked on October 20 and 21; the attack failed, but the project rebuilt the server from scratch and reset all passwords.
Why it matters
An attacker can take full control of the company's code server: steal source code, CI/CD secrets and tamper with software deliveries. The flaw requires no login, so any internet-exposed GitLab instance on a vulnerable version is an immediate target. The Alpine case shows that updating GitLab alone may not be enough when Ruby is self-managed.
What to do
Update immediately to GitLab 19.2.8, 19.3.5 or 19.4.2. If GitLab runs with your own Ruby (from source or your own container image), also update to Ruby 3.3.13, 3.4.12, 4.0.9 or later. Inventory exposed instances and, if attack signs appear, rebuild and reset credentials.
For the technical team
- CVE
- CVE-2026-97229
- Affected
- GitLab CE/EE · GitLab CE/EE 19.2 before 19.2.8, 19.3 before 19.3.5 and 19.4 before 19.4.2. Instances with unpatched self-managed Ruby: the flaw resides in Ruby, and Alpine remained vulnerable even after updating to GitLab 19.3.6 because its image runs standard Ruby.
- Exploitation
- Active exploitation confirmed by CISA: CVE added to KEV on October 29, 2026, with a federal deadline of November 1, 2026 (BOD 26-04). Alpine Linux reported an exploit attempt on October 20-21, 2026; in 4 crashes the attacker got partway through the exploit and failed at the next step; no evidence code ran, but it cannot be ruled out. BleepingComputer reports more than 1,000 servers still vulnerable. Ransomware use: unknown (CISA).
- Fix
- GitLab 19.2.8, 19.3.5 and 19.4.2. With your own Ruby (from source or your own container image), also Ruby 3.3.13, 3.4.12, 4.0.9 or later; upgrading GitLab alone does not fix that scenario. CISA requires mitigation per vendor instructions or discontinuing the product if no fix is available.
- Vector
- Integer overflow or wraparound from insufficient regular expression validation in Onigmo, Ruby's regex engine. An unauthenticated user submits a crafted regex in a CI/CD configuration and executes arbitrary code on the GitLab server. In the Alpine attack, the attacker used a newly registered account to send crafted CI configurations that crashed the worker process.
- More details
- GitLab advisory published October 12, 2026. The attacker downloaded Alpine's GitLab container image, suggesting the exploit was being tuned to the exact build. Alpine rebuilt the instance from scratch, reset all passwords and observed automated login attempts with passwords compromised in other leaks; checks showed no tampering with the aports repository, packages or the October 21 releases. CISA requires federal agencies to patch within three days (BOD 26-04).
Timeline
More than 1,000 GitLab servers remain exposed to the flaw; affected and fixed versions were detailed.
BleepingComputer reports over 1,000 GitLab servers remain vulnerable to ongoing remote code execution attacks.
BleepingComputer reports that CISA now lists the max-severity GitLab flaw as exploited in the wild.
Want the next updates in your inbox? Get the daily edition →
See all 11 updates
SecurityWeek details that CVE-2026-97229 allows unauthenticated attackers to execute arbitrary code on Alpine Linux's GitLab server.
CISA officially adds GitLab flaw CVE-2026-97229 to the KEV catalog, citing active exploitation.
CISA adds the GitLab CVSS 10.0 flaw to the KEV catalog; federal agencies must patch by November 1.
Tweet confirms CVE-2026-97229 was added to CISA KEV on October 29, 2026, with technical details: integer overflow in the CI/CD regex compiler enables unauthenticated RCE.
X post reiterates CISA's confirmation that CVE-2026-97229 is actively exploited and that the attempt against Alpine Linux's GitLab left no proof of success; the project's earlier upgrade had missed the flaw, which sits in Ruby.
CISA adds CVE-2026-97229 to the KEV catalog and confirms active exploitation, with a federal deadline of November 1, 2026.
The flaw is now tracked as CVE-2026-97229, a CVSS 10.0 RCE via regex in CI config; the attempt came a week after the fix and did not succeed.
First report: RCE exploit attempt on Alpine's GitLab leads to server rebuild and password reset.
Sources 8 sources
- @TheHackersNews @TheHackersNews
- Attacker Tried to Exploit Alpine Linux’s GitLab via CVSS 10.0 Flaw Its Ruby Left Open The Hacker News
- CVE-2026-97229: GitLab Community Edition and Enterprise Edition (GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability) CISA KEV
- @IntCyberDigest @IntCyberDigest
- @DailyDarkWeb @DailyDarkWeb
See all 11 sources
- @TheHackersNews @TheHackersNews
- CISA Adds Actively Exploited GitLab RCE and Cisco Firewall DoS Flaws to KEV The Hacker News
- Max-Severity GitLab Vulnerability Exploited Against Alpine Linux SecurityWeek
- @BleepinComputer @BleepinComputer
- @BleepinComputer @BleepinComputer
- @DarkWebInformer @DarkWebInformer
