Threat reportVulnerabilityTL-2026-3413
CVE-2026-97229: Critical GitLab Unauthenticated RCE via CI/CD Regex Compiler Integer Overflow
CVE-2026-97229 (TL-2026-3413) is a critical-severity software vulnerability scored CVSS 10, first published 2026-10-13 and last reviewed 2026-10-14. It has no confirmed attribution, affects GitLab GitLab Community Edition / Enterprise Edition (self-managed), references 2 CVEs (CVE-2026-97229, CVE-2026-93577), maps to 8 MITRE ATT&CK techniques (T1005, T1059, T1136), and is covered by 9 detection rules and 11 indicators of compromise.
- CVSS
- 10/10Critical
- CVEs
- 2Referenced vulnerabilities
- Techniques
- 8MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 11Indicators of compromise
Key facts for TL-2026-3413
- Threat ID
- TL-2026-3413
- Severity
- CRITICAL
- CVSS
- 10 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, software-development, government administration, finance, health
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 11
- Updates
- 2026-10-14 · revalidated 1× · latest source
How CVE-2026-97229 works
CVE-2026-97229 is a CVSS 10.0 integer overflow/wraparound (CWE-190) in the CI/CD regular expression compiler of GitLab CE/EE that lets an unauthenticated attacker execute arbitrary code on the server through a specially crafted regular expression in a CI/CD configuration. GitLab fixed it in 19.2.8, 19.3.5 and 19.4.2 on 2026-10-12; no in-the-wild exploitation is confirmed.
GitLab's security release of 2026-10-12 (patch releases 19.4.2, 19.3.5 and 19.2.8, which together address 25 vulnerabilities) fixes CVE-2026-97229, titled 'Integer Overflow issue in CI/CD Regular Expression Compiler'. Per the vendor and NVD, insufficient validation of a specially crafted regular expression in a CI/CD configuration can trigger an integer overflow or wraparound (CWE-190) and result in arbitrary code execution on the GitLab server by an unauthenticated user. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (10.0), i.e. network reachable, low complexity, no privileges, no user interaction, with scope change.
Affected versions are GitLab CE/EE 19.2 before 19.2.8, 19.3 before 19.3.5 and 19.4 before 19.4.2. GitLab states that GitLab.com and GitLab Dedicated are already protected; self-managed installations must upgrade. The flaw was reported by Johan Carlsson (joaxcar) through GitLab's HackerOne bug bounty program (NVD references HackerOne reports 4055749 and 4058589).
The same component was patched shortly before: CVE-2026-93577 ('Integer Overflow issue in Regular Expression Compiler', CVSS 9.9, AV:N/AC:L/PR:L, authenticated), fixed on 2026-09-23 in 19.4.1, 19.3.3 and 19.2.7. CVE-2026-97229 is a separate record with the same bug class but no privileges required. The sources reviewed do not state whether the two are related as an incomplete fix, so treat that as unestablished.
Exploitation status: SOCRadar reports no confirmed in-the-wild exploitation and notes that public exploit claims exist but a reliable working PoC is not confirmed. The vulnerability was not found in the CISA KEV catalog checked on 2026-10-13 (catalog dated 2026-10-08; only the first 100,000 characters of the feed were read, so this is not a full-catalog confirmation). The vendor has published no CVE-specific IOCs or mitigations. Because no exploit mechanics are public, the indicators below are hunting guidance taken from the SOCRadar article, not observed attacker artifacts.
Impact per the source: full server compromise, with potential exposure of source code, CI/CD variables, tokens and credentials. Defenders should hunt for unusual unauthenticated requests to the instance, unexpected processes on the GitLab host, new users or tokens, repository changes, suspicious credential access and suspicious outbound connections. No network IOCs (IPs, domains) are known, so no BeaconBeagle correlation was applicable.
MITRE ATT&CK techniques used in TL-2026-3413
Collection
T1005 Data from Local System; T1213.003 Code Repositories
Execution
T1059 Command and Scripting Interpreter
Persistence
Initial Access
T1190 Exploit Public-Facing Application
Credential Access
T1528 Steal Application Access Token; T1552 Unsecured Credentials
Resource Development
Affected products and versions in CVE-2026-97229
- GitLab — GitLab Community Edition / Enterprise Edition (self-managed)
Vulnerable versions: 19.2 before 19.2.8; 19.3 before 19.3.5; 19.4 before 19.4.2
Fixed in: 19.2.8; 19.3.5; 19.4.2
Remediation for CVE-2026-97229
Patches
- GitLab 19.4.2
- GitLab 19.3.5
- GitLab 19.2.8
Immediate actions
- Upgrade self-managed GitLab CE/EE to 19.4.2, 19.3.5 or 19.2.8 (or later) immediately
- Restrict public/network access to the GitLab instance until patched
- Hunt for unusual unauthenticated requests, unexpected processes on the GitLab host, new users/tokens, repository changes and suspicious outbound connections
Workarounds
- No vendor workaround published; limit network exposure of the instance until upgraded
Longer-term hardening
- Rotate CI/CD variables, access tokens and credentials stored on any instance that was exposed while unpatched
- Keep GitLab on a regular patch cadence; this is the second CI/CD regex compiler integer overflow fixed within three weeks
CVEs associated with CVE-2026-97229
Weaknesses (CWE) in CVE-2026-97229
Timeline of CVE-2026-97229
- GitLab releases 19.4.1, 19.3.3 and 19.2.7 fixing CVE-2026-93577, an authenticated (CVSS 9.9) integer overflow in the same CI/CD regular expression compiler.
- CVE-2026-93577 is published; third-party databases (Wiz, SentinelOne, OpenCVE) list it as arbitrary code execution via crafted CI/CD regex.
- GitLab ships critical patch releases 19.4.2, 19.3.5 and 19.2.8 (25 security fixes) including CVE-2026-97229; GitLab.com and Dedicated are already protected. Reporter credited: joaxcar via HackerOne.
- GitLab's patch release page rates CVE-2026-97229 Critical (CVSS 10.0, AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) among 25 fixes (1 Critical, 5 High, others Medium/Low) and strongly recommends upgrading all affected installations; it notes 19.3.4 had a merge request page bug with the Ona integration, fixed in 19.3.5, so 19.3.5 is the version to deploy.
- SOCRadar publishes analysis: no confirmed in-the-wild exploitation, public exploit claims exist but no verified working PoC; vendor has not published CVE-specific IOCs.
- CVE-2026-97229 is published in NVD at 02:17 UTC with CVSS 3.1 base score 10.0 and CWE-190.
- On the publication date of the SOCRadar analysis, CVE-2026-97229 was not found in the CISA KEV catalog (catalog dated 2026-10-08; partial feed read), and no vendor-published IOCs or workarounds existed.
- Orca Security reports that Rapid7 independently reproduced arbitrary code execution on an unpatched official GitLab CE 19.4.1 image; exploitation requires crafted regex in .gitlab-ci.yml plus UTF-8 characters in repository paths. Other outlets state no public PoC was confirmed; no in-the-wild exploitation confirmed.
Update history for TL-2026-3413
- 2026-10-14 — Critical GitLab RCE Lets Unauthenticated Attackers Execute Code on Servers (CVE-2026-97229): What changed Exploitability THEORETICAL - POC_PUBLIC on Orca Security's report (2026-10-14) that Rapid7 reproduced code execution on GitLab CE 19.4.1. Severity, CVSS 10.0, status and patch versions unchanged. New indicators (5) Behavioral h
Sources cited for CVE-2026-97229
- SOCRadar: CVE-2026-97229 Critical GitLab RCE
- GitLab Critical Patch Release: 19.4.2, 19.3.5, 19.2.8
- NVD: CVE-2026-97229
- GitLab issue 630686 (referenced by NVD)
- HackerOne report 4055749 (referenced by NVD)
- HackerOne report 4058589 (referenced by NVD)
- GitLab Critical Patch Release: 19.4.1, 19.3.3, 19.2.7 (CVE-2026-93577, related)
- Wiz Vulnerability Database: CVE-2026-93577 (related)
Detection coverage for TL-2026-3413
As of 2026-10-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3413 across Splunk SPL, Microsoft KQL and Sigma, covering 11 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.