GitLabAnalysisCISA adds critical GitLab CI/CD remote code execution flaw to KEV catalog
What happened.CISA added a critical remote code execution vulnerability in GitLab Community and Enterprise Editions to its Known Exploited Vulnerabilities catalog following documented attacks against self-managed installations.
Why it matters.Continuous integration servers hold production deployment tokens, repository secrets, and direct access to deployment clusters. When unauthenticated actors achieve arbitrary command execution through pipeline configuration parsing, the entire software supply chain is breached. Engineering organizations running self-managed GitLab infrastructure must upgrade to patched releases immediately. Platform teams should restrict public project creation and audit CI/CD runners for anomalous shell execution.
The technical specifications:
- Vulnerability mechanics: Tracked as CVE-2026-97229 with a maximum 10.0 CVSS rating, an integer overflow defect in the Onigmo regular expression compiler triggers heap corruption when parsing complex expressions.
- Exploitation path: Unauthenticated remote attackers submit crafted regular expressions inside pipeline configuration files, enabling arbitrary operating system command execution with git service privileges on exposed hosts.
- Remediation releases: CISA issued Binding Operational Directive 26-04 mandating federal civilian agencies update self-managed instances to GitLab releases 19.4.2, 19.3.5, or 19.2.8 by November 1, 2026.
STORYLINE PROGRESSION & CONTEXT
This report represents a verified evolution of prior newsroom intelligence: