GitLab Patches CVSS 10.0 Flaw That Could Let Unauthenticated Users Run Server Code
GitLab patches CVSS 10.0 flaw allowing unauthenticated users to run server code.
Run GitLab?
Get an email when a reviewed story names GitLab, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
GitLab has released patches for a critical security vulnerability (CVE-2026-97229) with a CVSS score of 10.0. This flaw could allow unauthenticated users to execute arbitrary code on GitLab servers through a specially crafted regular expression in CI/CD configurations. The company also addressed three high-severity bugs, including cross-site scripting and improper authorization vulnerabilities.
The lesson from this incident
Full lessonA critical vulnerability (CVE-2026-97229) in GitLab allowed unauthenticated attackers to execute arbitrary code on servers by exploiting malicious regular expressions embedded in CI/CD pipeline configurations — a CVSS 10.0 severity rating reflecting the maximum possible risk. The flaw required no credentials, dramatically lowering the barrier for exploitation and putting every unpatched GitLab instance at immediate risk of full server compromise. CI/CD pipelines are high-value targets because they sit at the heart of software delivery, meaning a successful attack could lead to supply chain compromise, code tampering, or credential theft. This incident underscores that developer tooling infrastructure carries the same critical security obligations as production systems and must be patched with urgency.
What helps against this
How we list vendors- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
- cve — CVE-2026-97229
- cve — CVE-2026-92883
- cve — CVE-2026-16301
- cve — CVE-2026-14814
- cve — CVE-2026-90970
- cve — CVE-2026-85706