CISA adds exploited GitLab CVE-2026-97229 to KEV

CISA added CVE-2026-97229 to its Known Exploited Vulnerabilities catalog on 29 October 2026 after confirming in-the-wild exploitation. This is the maximum-severity (CVSS 10.0) unauthenticated RCE in GitLab's CI/CD regular-expression compiler we covered when the patch shipped on 12 October — it is now being attacked. If you run self-managed GitLab with an internet-reachable instance, treat this as active-exploitation priority.

What the flaw does

An integer overflow (CWE-190) in the CI/CD regular-expression compiler lets a remote, unauthenticated attacker run arbitrary code on the GitLab server via a crafted regular expression in a CI/CD configuration. The underlying bug is in Onigmo, Ruby's regex engine — which is why the real fix is the Ruby update, not only the GitLab release. We documented that chain when Ruby shipped 4.0.9, 3.4.12 and 3.3.13 on 23 October. The flaw was reported through HackerOne by the researcher using the handle "joaxcar."

Affected and fixed

The fixes shipped in GitLab CE and EE 19.4.2, 19.3.5 and 19.2.8, per BleepingComputer. But patching GitLab alone is not enough if the host's Ruby is unpatched: SecurityWeek reports that Alpine Linux's instance was on GitLab 19.3.6 and still affected, because the bug lives in Ruby's Onigmo. Alpine's guidance is Ruby 3.3.13, 3.4.12, 4.0.9 or later.

Exploitation status

Alpine Linux disclosed that on 20–21 October an attacker using a newly registered account sent crafted CI configurations that crashed the worker process; four crashes got partway through the exploit before failing. The attacker also pulled Alpine's GitLab container image, which Alpine suspects was used to tune the exploit locally. Alpine found no evidence code ran on the server but could not rule it out, rebuilt the instance, and reset all passwords. GitLab released threat detections for self-managed customers after observing exploitation attempts. Shadowserver tracks roughly 2,800 internet-exposed GitLab CE instances; it does not report how many are patched.

Action checklist

1. Patch GitLab to 19.4.2, 19.3.5 or 19.2.8 — and patch the host's Ruby to 3.3.13 / 3.4.12 / 4.0.9 or later. The Ruby update is the one that actually closes the Onigmo bug.
2. If your management interface is internet-reachable, do it first.
3. Enable GitLab's self-managed threat detections and review CI/CD job logs for crafted-regex configs from newly created accounts.
4. US federal agencies are bound by BOD 26-04 on the KEV clock — treat that deadline as the bar for everyone.
5. Assume any instance exposed before patching may have been probed: hunt for unexpected code execution and worker crashes, and consider credential rotation.

Context

This is the same Onigmo regex-engine family that produced a run of critical GitLab RCEs this month — CVE-2026-89078, -93577, -97229 and -110264 all trace to it. The pattern is consistent: a patch lands, exposed instances lag, and exploitation follows within weeks. The KEV add is the signal that the lag window for CVE-2026-97229 is closing.