Threat Intelligence

GitLab Fixes Maximum-Severity Flaw That Could Let Unauthenticated Attackers Run Code on Servers

The Hacker News · 13 Oct 2026

Key Takeaway If you run a self-hosted GitLab server, update to a patched version (19.4.2, 19.3.5 or 19.2.8) as soon as possible rather than waiting for a routine maintenance window.

GitLab has released patches for a maximum-severity vulnerability affecting its Community Edition (CE) and Enterprise Edition (EE) software. Tracked as CVE-2026-97229 and scored 10.0 on the CVSS scale, the flaw is described as an integer overflow issue. In a Monday advisory, the company said that under certain conditions an unauthenticated user could have run arbitrary code on the GitLab server using a specially crafted regular expression in a CI/CD configuration, due to insufficient validation.

Fixes are available in versions 19.4.2, 19.3.5 and 19.2.8. GitLab also addressed three high-severity bugs in the same release. Businesses that host their own GitLab instance should check which version they run and apply the relevant update.

The disclosure follows a busy period for the vendor. Weeks earlier, GitLab fixed a critical flaw in its AI Gateway (CVE-2026-90970, CVSS 9.9), which could have let an authenticated user with Duo Agent Platform access escape a prompt template sandbox and run commands on the gateway. Last month, another maximum-severity flaw in GitLab CE and EE (CVE-2026-85706, CVSS 10.0) saw probing in the wild within hours of public disclosure. That history shows how quickly attackers can move once a GitLab flaw becomes public.

Summarised by CISO AI from The Hacker News, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.