Barsec Cyber Intel
Self-Hosted GitLab Flaw Is Being Exploited: Update Now
A flaw in GitLab can let an attacker run code on a self-hosted server without logging in. GitLab.com and GitLab Dedicated are already patched.
What happened
A critical GitLab vulnerability can allow someone on the internet to run code on a vulnerable self-hosted GitLab server without first logging in. The flaw sits in the part of GitLab that processes certain CI/CD configuration rules. A specially crafted configuration can trigger a bug that ultimately lets an attacker execute commands on the server. CISA added CVE-2026-97229 to its Known Exploited Vulnerabilities catalog on October 29, meaning there is evidence attackers are using it in the real world. GitLab has released fixed versions.
Why this matters
A self-hosted GitLab server can hold source code, deployment pipelines, API tokens, CI/CD secrets and credentials used to reach other systems. If an attacker takes over that server, the damage can extend beyond GitLab itself. This specifically affects organizations running their own GitLab CE or EE instance. GitLab.com and GitLab Dedicated are managed by GitLab and have already been patched.
What you should do
- GitLab 19.2: update to 19.2.8 or later.
- GitLab 19.3: update to 19.3.5 or later.
- GitLab 19.4: update to 19.4.2 or later.
- Review GitLab's published threat detections and server logs for suspicious CI/CD requests or abnormal worker activity if exposed while vulnerable.
- If compromise is suspected, treat CI/CD secrets, access tokens and deployment credentials used by that instance as potentially exposed.