GoKawiilOver 1,000 GitLab servers still unpatched against actively exploited RCE flaw
Shadowserver reports more than 1,000 internet-facing GitLab servers remain vulnerable to CVE-2026-97229, a critical integer overflow bug in GitLab's CI/CD Regular Expression Compiler that lets unauthenticated attackers run arbitrary code via crafted regex in pipeline configs. GitLab shipped fixes on October 12 in versions 19.4.2, 19.3.5 and 19.2.8, but CISA has now confirmed active exploitation and added the flaw to its Known Exploited Vulnerabilities catalog, giving federal agencies until Sunday to patch.
GoKawiil's interpretation of the reporting above, not reported fact.
The three-week gap between patch release and widespread exploitation shows how slowly many self-managed GitLab instances get updated, leaving thousands of code repositories exposed to takeover. CISA's KEV listing and deadline mainly bind federal agencies, but the public disclosure signals to attackers worldwide that unpatched servers remain an easy target, raising urgency for private organizations too. This marks the third major GitLab security issue disclosed this year, suggesting the platform's CI/CD and authentication components are drawing sustained attacker interest.
- Over 1,000 internet-exposed GitLab servers remain unpatched against CVE-2026-97229 despite fixes being available since October 12.
- CISA confirmed active exploitation and added the flaw to its KEV catalog, ordering federal agencies to patch by Sunday.
- The bug allows unauthenticated remote code execution via crafted regular expressions in CI/CD pipeline configurations, fixed in versions 19.4.2, 19.3.5, and 19.2.8.
Source: bleepingcomputer.com, 2026-11-02
Published there as: “Over 1,000 GitLab servers vulnerable to ongoing RCE attacks”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.