GitLab CE/EE RCE forces urgent upgrades for self-managed users after CERT-EU warning

Organisations running self-managed GitLab instances face immediate risk from a critical vulnerability that allows unauthenticated attackers to execute arbitrary code. The European Union Agency for Cybersecurity advises urgent upgrades to patched versions, starting with servers exposed to the internet, to prevent potential server compromise.

How does the vulnerability enable remote code execution?

The flaw, identified as CVE-2026-97229, resides within the regular expression compiler used by GitLab’s CI/CD pipelines. According to the official advisory from CERT-EU, weak validation of regular expressions leads to an integer overflow. An attacker can submit a specially crafted expression in a CI/CD configuration to trigger this overflow, resulting in arbitrary code execution on the server without requiring authentication.

What other security issues are included in the patch?

The release addresses 24 security issues in total. Beyond the critical RCE flaw, patches fix CVE-2026-92883, a cross-site scripting vulnerability rated CVSS 8.7 that allows authenticated users to run JavaScript in others’ browsers. It also resolves CVE-2026-16301, an authorisation flaw rated 8.5 enabling developers to run pipelines on protected branches without permission.

Which GitLab versions are affected by these flaws?

Self-managed instances of GitLab Community Edition and Enterprise Edition are affected. The vulnerabilities exist in versions prior to the 12 October 2026 updates. Users must upgrade to version 19.4.2, 19.3.4 or 19.2.8 to mitigate the risks. CERT-EU emphasises that all self-managed instances require upgrading, with internet-facing systems being the highest priority for remediation.

What is the immediate recommendation for IT managers?

CERT-EU strongly recommends upgrading self-managed GitLab CE and EE instances to the fixed versions as soon as possible. The advisory specifically notes that internet-facing instances should be addressed first due to the unauthenticated nature of the critical vulnerability. Delaying the update leaves servers exposed to remote code execution via the CI/CD configuration interface.

What to do and how to stay safe: GitLab

• Identify all self-managed GitLab Community and Enterprise Edition instances currently running versions prior to 19.4.2, 19.3.4 or 19.2.8.
• Prioritise patching internet-facing GitLab servers to mitigate the risk of unauthenticated remote code execution from the CI/CD module.
• Review CI/CD configurations for any unusual or complex regular expressions that might have been previously exploited or could trigger the integer overflow.
• Monitor system logs for signs of arbitrary code execution or unexpected pipeline runs on protected branches following the patch deployment.

General security guidance from the Phish Herald newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for the unauthenticated RCE vulnerability?

The vulnerability CVE-2026-97229 has a CVSS score of 10.0, indicating a critical severity level that allows unauthenticated remote code execution.

Does this affect GitLab SaaS customers?

The CERT-EU advisory specifically addresses self-managed GitLab Community Edition and Enterprise Edition instances; it does not mention GitLab’s hosted SaaS offering.

When were the patched versions released?

GitLab released the fixed versions 19.4.2, 19.3.4 and 19.2.8 on 12 October 2026, addressing 24 security issues including the critical RCE flaw.