CISA orders federal agencies to patch by 1 November under a binding directive, while urging other operators to act. GitLab has released fixes and threat detections for customers running their own servers.
The US Cybersecurity and Infrastructure Security Agency (CISA) added GitLab vulnerability CVE-2026-97229 to its Known Exploited Vulnerabilities catalogue on 29 October 2026, citing active exploitation. GitLab had released a patch earlier in October 2026.
BleepingComputer said CISA ordered federal agencies to secure their servers by 1 November 2026 under Binding Operational Directive 26-04. That is a mandatory federal deadline in its account. The directive applies only to federal agencies; CISA encouraged other security teams, including private-sector operators, to prioritize patching.
The flaw affects GitLab Community Edition and Enterprise Edition. It involves an integer overflow—a number-handling error—in the processing of regular expressions, which are patterns used to match text. The expressions appear in CI/CD configurations, which control automated software-building and testing tasks.
GitLab said insufficient checks on those expressions could, under certain conditions, let an attacker run code on the server without logging in. BleepingComputer credits the security researcher using the handle joaxcar with discovering the flaw.
Alpine Linux, a Linux distribution, disclosed unsuccessful attempts against its unpatched GitLab server on October 20 and 21, 2026, using specially crafted CI configurations, The Hacker News said. Further attempts on October 25 and 26 were blocked.
Alpine’s maintainers said they found no evidence that the attack succeeded but could not rule it out. They therefore treated the server as compromised and rebuilt it from scratch. Their checks showed that the aports repository, packages and October 21 releases had not been tampered with.
Shadowserver, an Internet threat watchdog, tracks nearly 2,800 Internet-exposed GitLab Community Edition servers. That measures exposure, not the number of vulnerable or compromised servers; Shadowserver has not said how many have been patched.
GitLab fixed the flaw in Community Edition and Enterprise Edition versions 19.4.2, 19.3.5 and 19.2.8. The company also released threat detections for customers running self-managed servers after detecting exploitation attempts. It urges administrators to patch immediately.
The proposed terms remain on hold. The inquiry will determine whether Meta is dominant in a relevant UK market and, if so, whether the terms abuse that position.
3 min
The agreement with 35 US states and Washington, DC requires GM to limit driving-data collection, protect personal information and strengthen privacy checks and dealership oversight.
3 min
The flaw can let an attacker restart affected firewalls without logging in. Cisco recommends upgrading to a fixed software release.
2 min
