GitLab Critical RCE Flaw CVE-2026-97229 Patching Urgent

GitLab has issued an urgent advisory for a critical remote code execution (RCE) vulnerability, tracked as CVE-2026-97229, affecting self-managed GitLab Community and Enterprise editions. The flaw resides in the CI/CD Regular Expression Compiler and has been assigned a CVSS score of 10.0, indicating maximum severity. While GitLab.com and Dedicated instances are already secured, all self-managed administrators are urged to apply updates immediately.

Technical analysis by Rapid7 confirmed that the exploit involves an integer overflow triggered by specially crafted regular expressions. While the vendor suggests the flaw can be reached unauthenticated, researchers noted that exploitation typically requires the ability to commit a malicious `.gitlab-ci.yml` configuration file and a repository path containing UTF-8 characters to a public project. Although no in-the-wild exploitation has been confirmed, the potential for impact is extreme, including full server compromise.

Additional vulnerabilities addressed in this cycle include CVE-2026-7767, an open redirect flaw in the Kubernetes proxy, and recent mentions of CVE-2026-19478, a critical code injection flaw. Organizations should prioritize these GitLab updates outside their normal patch windows to mitigate the risk of unauthorized access and data loss.