GitLab CE/EE: critical code execution flaw (CVE-2026-97229) exploited in the wild, fixed in 19.4.2, 19.3.5, 19.2.8
CVE-2026-10518 CVE-2026-4523 CVE-2026-84739 CVE-2026-89078 CVE-2026-8937 CVE-2026-92470 CVE-2026-92529 CVE-2026-92530 CVE-2026-92628 CVE-2026-92874 CVE-2026-93577 CVE-2026-97229
Published 30/10/2026 10:23
Timeline
3 events over 17 d
- 12/10/2026 16:57ConfirmedCERT-EU security advisories+16 d
- 29/10/2026ExploitedCISA Known Exploited Vulnerabilities+1 d 9 h
- 30/10/2026 10:23Published on WatchtowerPro CISO
In short
CVE-2026-97229 is a critical code execution flaw (CVSS 10.0) in self-managed GitLab CE and EE. CISA and VulnCheck list it as exploited, and Alpine Linux reports it was almost compromised through it. Update to 19.4.2, 19.3.5 or 19.2.8 or later now. GreyNoise reports a public exploit for CVE-2026-10518 (30/10/2026).
How bad is it
Critical. Exploited in the wild: an attacker who can get a crafted CI configuration into a project on a vulnerable GitLab server can run commands on it, and where anyone can self-register this needs no prior access.
Being exploited - on CISA's known-exploited list since 29/10/2026.
Severity score
The worst of 12 CVEs · CVSS from the vendor, via our research, read 29/10/2026. CVE-2026-92628, CVE-2026-92874, CVE-2026-93577: no score published yet.
What an attacker needs
- Internet access to itNot published yet
- A loginNot published yet
- A user to clickNot published yet
- Special settingsNot published yet
Red helps the attacker, blue holds them back, grey is not published yet.
If it works, an attacker can
- Run their own code on the system
Type: remote code execution.
A score is the worst case for the flaw, not a verdict on any one system. How we score · ReconX customers see which of their own systems are affected.
Affected versions
- Self-managed GitLab CE and EE: all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2.
- The public exploit module targets the official Docker images on Linux amd64.
Fixed in
- 19.4 branch: 19.4.2
- 19.3 branch: 19.3.5
- 19.2 branch: 19.2.8
What to do now
- Upgrade all self-managed GitLab CE/EE instances, starting with internet-facing ones, to 19.4.2, 19.3.5 or 19.2.8 or later (CERT-EU lists 19.3.4 for that branch, so use 19.3.5 or later).
- No vendor workaround was found in the sources, so updating is the only complete fix.
- Until the update is installed, you can reduce exposure by restricting who can sign up, create projects or push CI configuration, and by limiting access to the instance (VPN or IP allowlist). These are general suggestions, not vendor guidance. They reduce exposure and do not make a server safe.
- Check for Puma worker crashes or out-of-memory events, unexpected new projects or CI files with odd regular expressions, and commands run by the git user.
ReconX customers see the full notice - and their own systems
Our customers are alerted at every phase. Until a patch exists, the ReconX agent watches their servers from the inside for anomalies, and our outside view - the attacker's view - shows which systems to fix first.
In ReconX: the full analysis, 4 open questions, followed up as sources answer and all 12 sources with their dates. And technology matching: which of your systems run GitLab Community Edition and Enterprise Edition, at which version, fixed or not - and what each one needs.
Main sources
Known exploited: GitLab Community Edition and Enterprise Edition - GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability Vendor · 2026-016: Critical Vulnerability in GitLab CE and EE CERT · Multiples vulnérabilités dans GitLab (22 octobre 2026) CERT