GitLab: code execution without login in pipelines (CVE-2026-97229)

Code execution without login in GitLab CE and EE, via pipeline configuration. CVSS 10.0: update.

On 12 October 2026 GitLab fixed CVE-2026-97229, a critical vulnerability that allows a user without login to execute code on the server. The vector is a malformed regular expression entered in CI/CD pipeline settings, which is not adequately validated. The CVSS v3.1 score is 10.0.

The fixed versions are 19.2.8, 19.3.5 and 19.4.2, released the same day. The GitLab bulletin for 19.4.2 is the source for branch-specific details.

Update self-managed instances right away. After updating, check the logs for anomalous changes to pipeline configurations, since the vulnerability concerns precisely that entry point.

At a glance

What: Code execution on the GitLab server by a user without login, through a malformed regular expression in pipeline settings.
Severity: CVSS v3.1 10.0 (critical), according to NVD.
Affected versions: From 19.2 up to but excluding 19.2.8, and from 19.3 up to but excluding 19.3.5, according to NVD. The 19.4 branch is fixed in 19.4.2.
Fix: GitLab 19.2.8, 19.3.5 and 19.4.2, released on 12 October 2026.
Action: Update to the fixed release for your branch. Check the version installed on the instance.

Sources: NVD, CVE-2026-97229 · GitLab, patch release 19.4.2

← All articles