Threat reportVulnerabilityTL-2026-3356
GitLab CE/EE max-severity unauthenticated code execution flaw in CI/CD Regular Expression Compiler (CVE-2026-97229)
GitLab CE/EE max-severity unauthenticated code execution (TL-2026-3356) is a critical-severity software vulnerability scored CVSS 10, first published 2026-10-12. It has no confirmed attribution, affects GitLab GitLab Community Edition (CE) and Enterprise Edition (EE), references 4 CVEs (CVE-2026-97229, CVE-2026-93577, CVE-2026-89078), maps to 8 MITRE ATT&CK techniques (T1005, T1059, T1059.004), and is covered by 9 detection rules and 9 indicators of compromise.
- CVSS
- 10/10Critical
- CVEs
- 4Referenced vulnerabilities
- Techniques
- 8MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 9Indicators of compromise
Key facts for TL-2026-3356
- Threat ID
- TL-2026-3356
- Severity
- CRITICAL
- CVSS
- 10 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, software-development, government administration, finance, telecoms
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 9
Malware and tooling in GitLab CE/EE max-severity unauthenticated code execution
Malware and tooling: GitLab CI/CD Regular Expression Compiler, GitLab Regular Expression Parser
How GitLab CE/EE max-severity unauthenticated code execution works
GitLab disclosed CVE-2026-97229 (CVSS 10.0), an integer overflow in the CI/CD Regular Expression Compiler that could let an unauthenticated user execute arbitrary code on the GitLab server via a crafted regular expression in a CI/CD configuration. Fixed in GitLab CE/EE 19.2.8, 19.3.4 and 19.4.2; GitLab.com is already patched and self-managed instances need immediate action.
CVE-2026-97229 is an integer overflow (CWE-190) in the regular expression compiler that GitLab uses to parse, compile and evaluate regular expressions found in projects' CI/CD pipeline configuration files. GitLab's advisory states that, under certain conditions and due to insufficient regular expression validation, an unauthenticated user could execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration. GitLab scores the issue CVSS 3.1 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Affected versions are GitLab CE/EE 19.2 before 19.2.8, 19.3 before 19.3.4 and 19.4 before 19.4.2. The flaw was reported by the researcher 'joaxcar' through GitLab's HackerOne bug bounty program. The GitLab advisory does not list a CWE; CWE-190 is derived from the advisory title (integer overflow).
The fix shipped in patch release 19.4.2 (together with 19.3.4 and 19.2.8), which addresses 25 security vulnerabilities in total (CVE-2026-97229 plus 24 others ranging from low to high severity, including XSS, authorization and SSRF issues). GitLab.com and GitLab Dedicated are already patched. Single-node self-managed instances will see downtime during the upgrade; multi-node instances can apply the patch with zero-downtime procedures. At the time of the BleepingComputer report (2026-10-12) there was no reported active exploitation, no public proof-of-concept and no published indicators of compromise; the NVD API returned no record for the CVE at research time.
This appears closely related to an earlier fix: CVE-2026-93577, published with patch release 19.4.1/19.3.3/19.2.7 on 2026-09-23, is also an integer overflow in the same Regular Expression Compiler, reported by the same researcher, with CVSS 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) requiring an authenticated user. The same release also fixed CVE-2026-89078, a double free in the Regular Expression Parser (CVSS 9.9, authenticated, reported by joaxcar); that release fixed 11 vulnerabilities in total. Sources do not state that CVE-2026-97229 is a bypass or incomplete fix of CVE-2026-93577; defenders should treat the regex-compiler component as a repeated bug class and patch to the latest releases. Exploit mechanics beyond the advisory text (memory-corruption primitive, payload construction, reliability) are not publicly documented.
GitLab self-managed servers have a recent history of rapid weaponization: BleepingComputer notes CVE-2026-85706, a max-severity path traversal / authentication bypass in the repository commits API (fixed 2026-09-12 in 19.1.8, 19.2.6 and 19.3.2), was added to CISA's KEV catalog, with internet-wide probing and public PoC code reported shortly after disclosure per third-party reporting (SOC Prime, Rapid7, SOCRadar). That is a separate flaw and not evidence of exploitation of CVE-2026-97229, but it justifies urgent patching.
Defensive relevance: a self-managed GitLab server holds source code, CI/CD variables, runner registration tokens, deploy keys and service credentials, so code execution on the application host is a high-value supply-chain pivot. Post-exploitation techniques mapped below are assessed impacts of server-side code execution on a CI/CD platform and are not reported in-the-wild behavior.
MITRE ATT&CK techniques used in TL-2026-3356
Collection
T1005 Data from Local System; T1213.003 Data from Information Repositories: Code Repositories
Execution
T1059 Command and Scripting Interpreter; T1059.004 Command and Scripting Interpreter: Unix Shell
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application; T1195.002 Supply Chain Compromise: Compromise Software Supply Chain
Credential Access
Affected products and versions in GitLab CE/EE max-severity unauthenticated code execution
- GitLab — GitLab Community Edition (CE) and Enterprise Edition (EE)
Vulnerable versions: 19.2 before 19.2.8; 19.3 before 19.3.4; 19.4 before 19.4.2
Fixed in: 19.2.8; 19.3.4; 19.4.2
Remediation for GitLab CE/EE max-severity unauthenticated code execution
Patches
- GitLab CE/EE 19.2.8
- GitLab CE/EE 19.3.4
- GitLab CE/EE 19.4.2
Immediate actions
- Upgrade self-managed GitLab CE/EE to 19.2.8, 19.3.4 or 19.4.2 (or later) immediately
- Review GitLab application, Rails and Sidekiq logs and runner activity for anomalous pipeline creation, unusual .gitlab-ci.yml regular expressions and unexpected child processes of the GitLab application
- Restrict network exposure of self-managed instances (VPN / IP allowlisting) until patched
Workarounds
- No vendor workaround stated in sources; GitLab.com and GitLab Dedicated are already patched
- For the related authenticated CVE-2026-93577, third-party sources suggest limiting who may modify CI/CD configuration (Developer-level access, protected branches); this is not a substitute for patching
Longer-term hardening
- Subscribe to GitLab security release notifications and patch critical releases within days
- Rotate CI/CD variables, runner tokens, deploy keys and access tokens if compromise is suspected
- Monitor GitLab host with EDR and alert on shell or interpreter children of GitLab application processes
CVEs associated with GitLab CE/EE max-severity unauthenticated code execution
CVE-2026-97229, CVE-2026-93577, CVE-2026-89078, CVE-2026-85706
Weaknesses (CWE) in GitLab CE/EE max-severity unauthenticated code execution
Timeline of GitLab CE/EE max-severity unauthenticated code execution
- Separate GitLab max-severity flaw CVE-2026-85706 (path traversal / auth bypass) added to CISA KEV per third-party reporting, with internet-wide probing observed; context for the elevated risk to self-managed GitLab
- GitLab patches CVE-2026-85706 in 19.1.8, 19.2.6 and 19.3.2
- GitLab releases patch 19.4.1/19.3.3/19.2.7 (11 fixes) including the related authenticated regex-compiler integer overflow CVE-2026-93577 (CVSS 9.9) and double free CVE-2026-89078 (CVSS 9.9), both reported by joaxcar via HackerOne
- Third-party databases (Wiz, OpenCVE) index CVE-2026-93577 for GitLab 19.2-19.4
- BleepingComputer reports the max-severity flaw; no active exploitation, public PoC or IOCs reported
- GitLab states GitLab.com and Dedicated are already patched; self-managed instances must upgrade
- GitLab patch release 19.4.2 (with 19.3.4 and 19.2.8) fixes CVE-2026-97229 and 24 other security issues
Sources cited for GitLab CE/EE max-severity unauthenticated code execution
- BleepingComputer: GitLab warns of max severity code execution vulnerability in regex compiler engine
- GitLab Patch Release 19.4.2 - CVE-2026-97229 integer overflow issue in CI/CD Regular Expression Compiler
- GitLab Critical Patch Release: 19.4.1, 19.3.3, 19.2.7 (CVE-2026-93577 and CVE-2026-89078, related regex compiler/parser flaws)
- stack.watch: GitLab CE 19.2-19.4 CI/CD Regex Integer Overflow (CVE-2026-93577)
- Wiz Vulnerability Database: CVE-2026-93577
- NVD: CVE-2026-93577
- OpenCVE: CVE-2026-93577
- SOC Prime: CVE-2026-85706 Critical GitLab Path Traversal Flaw Exploited in the Wild (separate, related-context GitLab flaw)
- Rapid7 ETR: CVE-2026-85706 Critical GitLab Path Traversal Exploited in the Wild
- TechRadar: CISA warns hackers are exploiting max severity GitLab flaw
Detection coverage for TL-2026-3356
As of 2026-10-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3356 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.