GitLab CVSS 10.0: A Regex Bug That Pwns Your Server With No Login

Here's the nightmare in one sentence: a single crafted regex hidden in a CI/CD config can hand full control of your GitLab server to a complete stranger — no account, no login, nothing. That's what the new GitLab CVSS 10.0, tracked as CVE-2026-97229, makes possible. GitLab shipped emergency patches on October 8 — versions 19.4.2, 19.3.4, and 19.2.8 — in a release fixing 24 security issues. If you self-host GitLab and it's reachable from the internet, stop reading and go patch.

What the GitLab CVSS 10.0 bug actually does

At its core is an integer overflow (CWE-190) in GitLab's CI/CD regex compiler — the component that processes regular expressions inside pipeline configurations. An attacker slips a malicious regex into a CI/CD config, the overflow trips during compilation, and suddenly they're executing code on the server. No authentication. No user interaction. Just a regex.

The CVSS vector reads like a horror-movie poster: AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. Translated: reachable over the network, trivial to exploit, zero privileges required, nobody has to click anything, and it escapes its original scope with total impact on confidentiality, integrity, and availability. A 10.0 is the highest score the scale allows, and this flaw earned it honestly.

Credit for the find goes to researcher 'joaxcar', who reported it through GitLab's HackerOne bug bounty program.

Third regex flaw in a month — that's a pattern, not bad luck

This is the third regex-engine vulnerability GitLab has patched in about a month. On September 23, two CVSS 9.9 regex bugs were fixed, including CVE-2026-93577 — which at least required the attacker to hold an account. This latest one dropped the auth requirement entirely, which is what pushed it from 9.9 territory into a full GitLab CVSS 10.0.

Three regex bugs in a month is not bad luck. It's a signal that the regex engine needs a proper security audit — or a rewrite — not another round of whack-a-mole. GitLab's engineers clearly know the component is hot. Attackers know it too, and the next flaw in this code will get exactly the same treatment.

The rest of the patch batch is ugly too

CVE-2026-97229 headlined a release that fixed 24 security issues, and the supporting cast deserves your attention:

• CVE-2026-92883 (CVSS 8.7): cross-site scripting in syntax highlighting. Code gets rendered constantly — every file view, every diff — which makes XSS there genuinely dangerous.
• CVE-2026-16301 (CVSS 8.5): an authorization flaw that let users with the Developer role run pipelines on protected branches. Protected branches exist precisely to stop that.
• A cache-poisoning bug (CVSS 8.2) that could expose protected CI/CD variables. Read that again: the secrets you explicitly marked as protected could leak.

Any one of these would make for a rough week. Bundled together, they settle the question of whether this release is optional. It isn't.

Why a GitLab takeover is the worst thing to lose

A compromised GitLab server is not just a compromised web app. It holds your source code, your CI/CD secrets, and your deployment keys — the three things an attacker needs to poison your builds, steal credentials, and pivot straight into production. We've watched stolen credentials turn into full breaches during October's breach wave, and a GitLab box is a skeleton key to everything downstream of it.

The absence of in-the-wild exploitation reports at disclosure should comfort you exactly zero. The flaw isn't in CISA's Known Exploited Vulnerabilities catalog yet, and nobody has publicly reported active attacks — but unauthenticated RCE on internet-facing DevOps infrastructure has a brutally short shelf life between disclosure and mass scanning. Ivanti's recent zero-day scramble showed how fast attackers weaponize this class of bug.

What to do right now

• Patch immediately if you self-manage GitLab: upgrade to 19.4.2, 19.3.4, or 19.2.8 depending on your track. Internet-facing instances go first.
• GitLab.com and Dedicated customers: already patched, no action needed — but confirm your version in the admin area instead of assuming.
• Rotate secrets after patching: CI/CD variables, deployment keys, runner tokens. If someone got in before you patched, stale credentials are still live.
• Hunt for traces: review recent pipeline configs and logs for unusual regex patterns or unexpected job activity.
• Shrink the attack surface: if your GitLab doesn't need to face the public internet, put it behind a VPN. Unauthenticated RCE can't reach what it can't see.
• Don't wait for the KEV catalog: CISA's list is a lagging indicator. And if you suspect credentials already leaked, check whether your data was caught in a breach.

If you're still unpatched because 'we'll catch it in the next maintenance window,' that window just moved to today. A no-auth CVSS 10.0 is the kind of bug that lands in ransomware playbooks within weeks. Patch, rotate your secrets, and move on.