What Happened
A critical GitLab vulnerability is being exploited in the wild, and the clock is running for MSPs. CVE-2026-97229 has a CVSS score of 10.0. It allows an unauthenticated attacker to execute arbitrary code on a self-managed GitLab server. If one of your clients is hit, you are the one who has to restore service, explain the outage and manage the cleanup. The fix is to upgrade self-managed instances to 19.4.2, 19.3.4 or 19.2.8.
GitLab released fixed versions 19.4.2, 19.3.4 and 19.2.8 on 12 October 2026. The release fixed 24 security issues, including this critical flaw. CERT-EU strongly recommends upgrading self-managed GitLab CE and EE instances as soon as possible, starting with internet-facing instances.
The threat is not theoretical. Alpine Linux said on 28 October that an attacker tried to exploit the vulnerability on its own GitLab server a week after the fix was released. Alpine found no evidence the attack worked. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on 30 October, citing active exploitation. By 2 November, BleepingComputer reported that over 1,000 internet-exposed GitLab servers were still unpatched.
Timeline
- 12 October 2026: GitLab released versions 19.4.2, 19.3.4 and 19.2.8, fixing 24 security issues including the critical vulnerability.
- 21 October 2026: GitLab published a security advisory addressing the critical flaw.
- 28 October 2026: Alpine Linux said an attacker tried to exploit the vulnerability on its GitLab server.
- 30 October 2026: CISA added CVE-2026-97229 to its Known Exploited Vulnerabilities catalog.
- 2 November 2026: BleepingComputer reported that over 1,000 internet-exposed GitLab servers were still unpatched.
Who Is Affected
Self-managed GitLab Community Edition and Enterprise Edition instances are affected. If you manage GitLab for clients, or if a client runs it on their own infrastructure, this advisory applies to you.
CERT-EU puts internet-facing instances at the top of the list. Those are the systems an attacker can reach without any prior access. That makes them the highest-risk items in your portfolio.
The advisory covers self-managed instances. The fixed versions are the ones to deploy across every client environment. If you are not sure which version a client runs, check before the attacker does.
Technical Details
CVE-2026-97229 is an integer overflow or wraparound vulnerability in GitLab Community Edition and Enterprise Edition. Its CVSS score is 10.0.
The attack vector is a crafted regular expression in a CI configuration. Successful exploitation lets an unauthenticated attacker execute arbitrary code on the GitLab server.
The fixed versions are 19.4.2, 19.3.4 and 19.2.8. Any self-managed instance running an older version is exposed.
Why This Matters for MSPs
A GitLab server is not just another application. It holds source code, deployment pipelines, environment variables and credentials. An attacker who gets code execution on that server can read secrets, modify code or plant backdoors in the next release.
For an MSP, the cost is concrete. You lose billable hours to incident response. You risk client trust. You may face contractual obligations around breach notification. The cheapest possible outcome is patching before an attacker gets in.
The 1,000-plus exposed servers reported by BleepingComputer mean the attack window is still open. Do not assume your clients are safe because they have not called you yet.
What MSPs Should Do About the GitLab Vulnerability
Work through these steps in order. The first two come directly from CERT-EU's advisory.
- Upgrade every self-managed GitLab CE and EE instance to a fixed version: 19.4.2, 19.3.4 or 19.2.8. Start with internet-facing instances.
- Run an assessment to identify compromised assets. CERT-EU also recommends this.
- Inventory all GitLab instances you manage and record their current versions. This tells you which clients still need attention.
- Review CI/CD pipeline definitions for suspicious regular expressions or unexpected changes. This is a standard hardening step after a GitLab security update.
- Monitor authentication logs and server activity for anomalies. If the vulnerability was exploited, the first signs are usually in the logs.
How EnterProtect Helps
EnterProtect backup keeps clean restorable copies of client systems and data. When a GitLab server is compromised, you need a known good point to come back to, not a copy that was taken after the attacker got in.
EnterProtect recovery gets a client running again after an incident. Restoring a server from backup is faster and more predictable than rebuilding from scratch.
EnterProtect vulnerability scanning helps you find exposed versions across client environments. That gives you a clearer picture of what needs to be patched and where your attention should go.
Frequently Asked Questions
What Is CVE-2026-97229?
CVE-2026-97229 is a critical vulnerability in GitLab Community Edition and Enterprise Edition with a CVSS score of 10.0. It is an integer overflow or wraparound vulnerability that allows an unauthenticated attacker to execute arbitrary code on a GitLab server. CISA has added it to the Known Exploited Vulnerabilities catalog because it is being actively exploited.
How Does the CVE-2026-97229 Attack Work?
The attack uses a crafted regular expression in a CI configuration. This lets an unauthenticated attacker trigger the vulnerability without valid credentials. The result is arbitrary code execution on the GitLab server.
Which GitLab Versions Are Affected?
Self-managed GitLab Community Edition and Enterprise Edition instances are affected. Fixed versions are 19.4.2, 19.3.4 and 19.2.8. Instances running older versions are exposed.
What Should I Do If a Client's GitLab Server Is Compromised?
Upgrade the instance to a fixed version and run an assessment to identify compromised assets, as CERT-EU recommends. Review CI/CD configurations for changes you did not make. Restore from a known good backup if you have one.
Why Is This GitLab Vulnerability Rated 10.0?
The CVSS score reflects that no authentication is required, the attack can be carried out remotely, and it gives the attacker code execution on the server. That combination is as severe as a vulnerability can be rated.
Is GitLab.com Affected by CVE-2026-97229?
The advisory covers self-managed GitLab Community Edition and Enterprise Edition instances. GitLab.com is a managed service, not a self-managed instance, so the same fixed versions do not apply. Check GitLab's own status and advisory pages for their managed offering.
Sources
- Attacker Tried to Exploit Alpine Linux’s GitLab via CVSS 10.0 Flaw Its Ruby Left Open (Hackernews)
- CISA Adds Actively Exploited GitLab RCE and Cisco Firewall DoS Flaws to KEV (Hackernews)
- Max-Severity GitLab Vulnerability Exploited Against Alpine Linux (Securityweek)
- CISA says max severity GitLab flaw now exploited in the wild (Bleepingcomputer)
- Over 1,000 GitLab servers vulnerable to ongoing RCE attacks (Bleepingcomputer)
- GitLab security advisory (AV26-1074) (Canada Alerts)
- 2026-019: Critical Vulnerability in GitLab Community and Enterprise Editions (Cert Eu)
- 2026-016: Critical Vulnerability in GitLab CE and EE (Cert Eu)