GitLab Patches Maximum-Severity RCE in Self-Managed Servers

GitLab has patched a maximum-severity vulnerability that could allow an unauthenticated attacker to execute arbitrary code on a self-managed GitLab server through a specially crafted regular expression in a CI/CD configuration.

Tracked as CVE-2026-97229, the flaw carries a CVSS score of 10.0. GitLab attributed it to insufficient validation in its CI/CD regular-expression compiler. Affected releases include all 19.2 versions before 19.2.8, 19.3 versions before 19.3.5 and 19.4 versions before 19.4.2. GitLab.com is already patched, and GitLab Dedicated customers do not need to act.

The exposure is unusually serious because a development platform sits at the center of source code, build pipelines, credentials and software releases. Code execution on that server could give an intruder a path to secrets, project changes or poisoned build output. GitLab has not said that the vulnerability is being exploited in the wild.

Administrators should upgrade immediately, then review logs and pipeline activity for signs of access before the patch was applied. Updating closes the known flaw, but it does not establish whether a vulnerable server was already compromised.