Attackers have begun exploiting a maximum-severity vulnerability in GitLab, and the US Cybersecurity and Infrastructure Security Agency confirmed the active attacks on Thursday. The flaw, tracked as CVE-2026-97229, was patched earlier this month. CISA added it to its Known Exploited Vulnerabilities Catalog and directed federal agencies to secure their servers by Sunday under Binding Operational Directive 26-04.
The vulnerability is an integer overflow weakness in the CI/CD Regular Expression Compiler, which parses, compiles, and evaluates regular expressions in pipeline configuration files. According to GitLab, insufficient validation of regular expressions could have allowed an unauthenticated user to run arbitrary code on the GitLab server through a specially crafted expression in a CI/CD configuration. The flaw was found by a security researcher known by the handle joaxcar.
GitLab shipped fixes in Community Edition and Enterprise Edition versions 19.4.2, 19.3.5, and 19.2.8, and urged administrators to patch their servers immediately. The company also released threat detections for customers running self-managed instances after it detected exploitation attempts.
BOD 26-04 applies only to federal agencies, but CISA encouraged all security teams, including those in the private sector, to make patching this flaw a priority in order to protect their networks from ongoing attacks. Internet threat watchdog Shadowserver tracks nearly 2,800 Internet-exposed GitLab Community Edition instances, though it has not said how many have been secured.
The GitLab flaw is the latest in a series of security issues the company has addressed since the start of the year. In January, GitLab patched a high-severity two-factor authentication bypass, CVE-2026-0723, that lets attackers who know a target's account ID get around two-factor authentication. Earlier this month it fixed another maximum-severity Regular Expression Compiler flaw, CVE-2026-110264, that could allow remote code execution.
Almost two weeks later, GitLab addressed a maximum-severity vulnerability in the repository commits API, CVE-2026-85706, that can be abused to read sensitive data such as credentials and other secrets from vulnerable servers. One day later, CISA added CVE-2026-85706 to its list of actively exploited flaws after cybersecurity firm watchTowr reported that attackers had begun scanning the Internet for unpatched GitLab servers.
CISA has tagged six GitLab vulnerabilities as exploited in the wild since November 2021, including two tracked as CVE-2021-22175 and CVE-2021-39935 in February of this year. GitLab's DevSecOps platform is used by more than 50% of Fortune 100 companies and has over 70 million registered users worldwide.
More cybersecurity news from TechManNews.
