GitLab RCE Flaw Leaves Over 1,000 Servers Exposed

A critical GitLab RCE flaw remains unpatched on more than 1,000 internet-accessible servers despite ongoing attacks. Shadowserver reported the exposure after GitLab released security updates on October 12, leaving administrators with an urgent patching priority.

GitLab RCE Flaw Affects Pipeline Configuration Processing

The vulnerability, tracked as CVE-2026-97229, involves an integer overflow in GitLab’s CI/CD Regular Expression Compiler. This component processes regular expressions within pipeline configuration files. Under certain conditions, an unauthenticated attacker can submit a malicious expression and execute arbitrary code on the server.

GitLab attributed the issue to insufficient regular expression validation. The company released corrections for both Community Edition and Enterprise Edition three weeks before the latest exposure report. However, Shadowserver’s findings show that more than 1,000 publicly accessible installations still lack protection against this vulnerability.

The October 12 security releases addressed the flaw in the following versions:

GitLab release branch	Fixed version
19.4	19.4.2
19.3	19.3.5
19.2	19.2.8

GitLab urged administrators of self-managed installations to upgrade immediately. Meanwhile, the company said GitLab.com already ran a patched version when it announced the fixes. It also stated that GitLab Dedicated customers did not need to take action.

CISA Confirms Active Exploitation

CISA added CVE-2026-97229 to its Known Exploited Vulnerabilities catalogue after confirming exploitation in real-world attacks. The agency also directed federal agencies to secure affected servers by its mandated deadline. Consequently, the vulnerability represents an established operational threat rather than a theoretical attack scenario.

Shadowserver disclosed its latest figures over the weekend and reiterated them on Sunday. Its monitoring identified more than 1,000 instances vulnerable to the GitLab RCE flaw. However, that number measures exposed, vulnerable installations and does not establish how many attackers have successfully compromised.

The remaining exposure is significant because GitLab environments support software development and automated delivery workflows. Unauthorised code execution could give attackers access to the affected server’s resources. Nevertheless, the supplied report does not identify specific victims or describe the outcomes of individual attacks.

Separate Vulnerability Affects Over 11,300 Instances

Shadowserver also reported more than 11,300 instances vulnerable to CVE-2026-110264. This separate, maximum-severity vulnerability likewise affects the Regular Expression Compiler and can allow arbitrary code execution. GitLab addressed it in another security release last month.

The watchdog observes approximately 39,000 GitLab instances each day. However, the two vulnerability counts may include overlapping systems, so they should not be combined into a unique server total. The figures nevertheless show that substantial patching gaps extend beyond the flaw currently listed by CISA.

Earlier GitLab Flaws Also Drew Attacker Interest

GitLab has addressed several other serious vulnerabilities during 2026. In January, it patched CVE-2026-0723, a high-severity issue that could bypass two-factor authentication. Later, it corrected CVE-2026-85706, a maximum-severity path traversal flaw in the repository commits API.

Attackers could exploit that September vulnerability to obtain credentials and other secrets. CISA subsequently listed it as actively exploited after researchers reported scanning activity. Since November 2021, the agency has added six GitLab vulnerabilities to its catalogue, including one associated with ransomware attacks.