CISA adds GitLab RCE flaw to KEV, citing active exploitation

CISA added a critical GitLab remote code execution flaw to its Known Exploited Vulnerabilities catalog on Thursday, citing evidence of active exploitation, The Hacker News reported on October 30, 2026. The same update also listed a denial-of-service flaw in Cisco firewall software.

The GitLab issue, tracked as CVE-2026-97229, is an integer overflow or wraparound weakness in GitLab Community Edition and Enterprise Edition. According to the vendor description, it affects versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. Under certain conditions, an unauthenticated user could execute arbitrary code on the GitLab server by supplying a specially crafted regular expression in a CI/CD configuration, which the description attributes to insufficient regular expression validation. GitLab rates the flaw 10.0 on CVSS version 3.1.

GitLab says it has remediated the issue, and its patch release notes for 19.4.2 are among the linked references. CISA's required action is to apply mitigations per vendor instructions under its risk-based patching directive, with a due date of November 1, 2026. The agency lists ransomware use as unknown.

Why it matters: GitLab servers often hold source code, CI/CD secrets and pipeline credentials, so code execution there can reach far beyond one host. The KEV listing means exploitation is no longer theoretical.

Defenders should inventory exposed GitLab instances, confirm which release they run against the affected ranges, and move to a fixed version using vendor guidance. Treat CI/CD configuration access as sensitive, and review pipeline logs and server activity for signs of abuse.

CVE references

CVE-2026-97229