GitLab issues urgent patches for CVE-2026-97229 RCE and authorization flaws in 19.4.2
Self-managed GitLab administrators must upgrade to 19.4.2, 19.3.4 or 19.2.8 to address a remote code execution vulnerability and multiple authorization bypasses.
Key points
- GitLab released patches on October 8, 2026, for versions 19.4.2, 19.3.4 and 19.2.8.
- CVE-2026-97229 allows unauthenticated users to execute arbitrary code via crafted regular expressions.
- GitLab Dedicated customers and GitLab.com users are already protected and need no action.
GitLab released critical security updates for its Community and Enterprise Editions on October 8, 2026. The vendor issued versions 19.4.2, 19.3.4 and 19.2.8 to address a remote code execution flaw and numerous authorization weaknesses. Self-managed installations must upgrade immediately to mitigate these risks.
Which vulnerabilities are fixed in this release?
The update addresses CVE-2026-97229, an integer overflow in the CI/CD regular expression compiler that could allow unauthenticated remote code execution. It also fixes a cross-site scripting issue in syntax highlighting, a sensitive information exposure in GitLab Pages, and an open redirect in the Kubernetes proxy.
How many authorization flaws are included?
The patch resolves multiple incorrect authorization and privilege assignment issues. These affect downstream pipeline creation, scheduled pipeline execution, GraphQL notes and work items, merge request approvals, package registries, and fine-grained personal access tokens. Some flaws allow bypassing governance controls or accessing project CI/CD settings improperly.
Who is affected and who is safe?
Self-managed GitLab installations running versions 19.2 through 19.4 are affected. GitLab.com is already running the patched version, and GitLab Dedicated customers do not need to take action. The vendor strongly recommends all self-managed users upgrade to the latest patch release for their supported version to maintain security hygiene.
When will vulnerability details be public?
GitLab will make the issues detailing each vulnerability public on its issue tracker 90 days after the release in which they were patched. This aligns with the vendor’s standard disclosure policy for security fixes. Details about the specific mechanics of the authorization bypasses will remain private until that period expires.
Background: Integer overflow vulnerabilities
An integer overflow occurs when a calculation produces a number too large for the allocated storage space. The value wraps around to a small or negative number. This unexpected change can break security checks, cause crashes, or allow unauthorized memory access. Understanding this helps you recognize why software behaves unpredictably under stress.
Read the full guide: Integer Overflow Vulnerabilities Explained: Causes, Risks, and Fixes
What to do and how to stay safe: GitLab
- Verify your self-managed GitLab version against the affected list (19.2 to 19.4) and schedule an immediate upgrade.
- Review CI/CD configurations for unusual regular expressions that might exploit the integer overflow flaw.
- Audit access logs for unauthorized attempts to create pipelines or access package registries.
- Monitor the GitLab issue tracker for detailed vulnerability disclosures 90 days post-release.
Step-by-step guide: Vulnerability Scanning: What It Finds and What It Misses
General security guidance from the TechSec Feed newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Is GitLab.com vulnerable to CVE-2026-97229?
No, GitLab.com is already running the patched version and is not affected by this vulnerability.
Do GitLab Dedicated customers need to upgrade?
No, GitLab Dedicated customers do not need to take action as their instances are managed by GitLab.
How soon will details about the authorization flaws be released?
Details will be made public on the issue tracker 90 days after the patch release date.
