# CVE-2026-97229: Critical GitLab Unauthenticated RCE via CI/CD Regex Compiler Integer Overflow

> CVE-2026-97229 is a CVSS 10.0 integer overflow/wraparound (CWE-190) in the CI/CD regular expression compiler of GitLab CE/EE that lets an unauthenticated attacker execute arbitrary code on the server through a specially crafted regular expression in a CI/CD configuration. GitLab fixed it in 19.2.8, 19.3.5 and 19.4.2 on 2026-10-12; no in-the-wild exploitation is confirmed.

- **Published:** 2026-10-13T13:49:43Z
- **Last reviewed:** 2026-10-14T20:45:51.269Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3413
- **ID:** TL-2026-3413
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 11 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-97229, CVE-2026-93577

## Description

GitLab's security release of 2026-10-12 (patch releases 19.4.2, 19.3.5 and 19.2.8, which together address 25 vulnerabilities) fixes CVE-2026-97229, titled 'Integer Overflow issue in CI/CD Regular Expression Compiler'. Per the vendor and NVD, insufficient validation of a specially crafted regular expression in a CI/CD configuration can trigger an integer overflow or wraparound (CWE-190) and result in arbitrary code execution on the GitLab server by an unauthenticated user. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (10.0), i.e. network reachable, low complexity, no privileges, no user interaction, with scope change.

Affected versions are GitLab CE/EE 19.2 before 19.2.8, 19.3 before 19.3.5 and 19.4 before 19.4.2. GitLab states that GitLab.com and GitLab Dedicated are already protected; self-managed installations must upgrade. The flaw was reported by Johan Carlsson (joaxcar) through GitLab's HackerOne bug bounty program (NVD references HackerOne reports 4055749 and 4058589).

The same component was patched shortly before: CVE-2026-93577 ('Integer Overflow issue in Regular Expression Compiler', CVSS 9.9, AV:N/AC:L/PR:L, authenticated), fixed on 2026-09-23 in 19.4.1, 19.3.3 and 19.2.7. CVE-2026-97229 is a separate record with the same bug class but no privileges required. The sources reviewed do not state whether the two are related as an incomplete fix, so treat that as unestablished.

Exploitation status: SOCRadar reports no confirmed in-the-wild exploitation and notes that public exploit claims exist but a reliable working PoC is not confirmed. The vulnerability was not found in the CISA KEV catalog checked on 2026-10-13 (catalog dated 2026-10-08; only the first 100,000 characters of the feed were read, so this is not a full-catalog confirmation). The vendor has published no CVE-specific IOCs or mitigations. Because no exploit mechanics are public, the indicators below are hunting guidance taken from the SOCRadar article, not observed attacker artifacts.

Impact per the source: full server compromise, with potential exposure of source code, CI/CD variables, tokens and credentials. Defenders should hunt for unusual unauthenticated requests to the instance, unexpected processes on the GitLab host, new users or tokens, repository changes, suspicious credential access and suspicious outbound connections. No network IOCs (IPs, domains) are known, so no BeaconBeagle correlation was applicable.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1136 Create Account
- T1552 Unsecured Credentials
- T1528 Steal Application Access Token
- T1213.003 Code Repositories
- T1587.004 Develop Capabilities: Exploits
- T1005 Data from Local System

## Sources

- [SOCRadar: CVE-2026-97229 Critical GitLab RCE](https://socradar.io/blog/cve-2026-97229-critical-gitlab-rce/)
- [GitLab Critical Patch Release: 19.4.2, 19.3.5, 19.2.8](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/)
- [NVD: CVE-2026-97229](https://nvd.nist.gov/vuln/detail/CVE-2026-97229)
- [GitLab issue 630686 (referenced by NVD)](https://gitlab.com/gitlab-org/gitlab/-/work_items/630686)
- [HackerOne report 4055749 (referenced by NVD)](https://hackerone.com/reports/4055749)
- [HackerOne report 4058589 (referenced by NVD)](https://hackerone.com/reports/4058589)
- [GitLab Critical Patch Release: 19.4.1, 19.3.3, 19.2.7 (CVE-2026-93577, related)](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-1-released/)
- [Wiz Vulnerability Database: CVE-2026-93577 (related)](https://www.wiz.io/vulnerability-database/cve/cve-2026-93577)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3413