CVE-2026-97229 Exploitation Attempts Observed — GitLab

Decision summary

What security teams need to know first

Direct answers before the deeper technical record.

What it is

CVE-2026-97229 is an unauthenticated Integer Overflow or Wraparound in GitLab. GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2...

Have exploitation attempts been observed?

Yes. Previdian sensors have observed 1 exploitation attempt, 1 unique attacker IP, and 1 country targeting CVE-2026-97229. First observed Oct 21, 2026. Listed in CISA KEV. Also reported by third-party sources. Confidence is confirmed.

Who is affected?

GitLab affected before 19.2.8.

What should we do?

Patch immediately, validate internet-facing exposure, and monitor for matching requests.

Overview

Integer Overflow or Wraparound in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.

Vendor Product Affected Status

GitLab Affected

GitLab

Before 19.2.8 Before 19.3.5 Before 19.4.2

Affected

Published: 13 Oct 2026
Attempts Observed Since: 21 Oct 2026
Attack vector: Remote
Complexity: Low
Privileges: None
User interaction: None

CVE References

CVE Record CVE.org · CVE Record https://www.cve.org/CVERecord?id=CVE-2026-97229
HackerOne Bug Bounty Report #4055749 hackerone.com · Exploit https://hackerone.com/reports/4055749
HackerOne Bug Bounty Report #4058589 hackerone.com · Exploit https://hackerone.com/reports/4058589
gitlab.com/gitlab-org/gitlab/-/work_items/630686 gitlab.com · CVE Record https://gitlab.com/gitlab-org/gitlab/-/work_items/630686
docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2... docs.gitlab.com · CVE Record https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-...

Exploitation evidence

Evidence of exploitation attempts

Third-party attestation and first-party sensor observation are shown separately so teams can judge the evidence chain.

Exploitation Attempts Observed in the Wild

Previdian sensor

Recorded 29 Oct 2026

Previdian sensors observed exploitation attempts targeting this vulnerability before a third-party report.

Proof of concept available

CVE

Recorded 13 Oct 2026

Public scanner or PoC coverage increases practical exploitability.

Known exploited vulnerability sources

Per-source evidence links for KEV attestations are available through the Previdian Pro API.

Learn about Pro API access

Source	Added
CISA First	2026-10-29 20:01 UTC
The Hacker News	2026-10-30 07:30 UTC
Security Affairs	2026-10-30 21:21 UTC

Sensor telemetry

Previdian Sensor Observations

Previdian sensor observations are exploitation attempts targeting this vulnerability. They do not show that the target was vulnerable or that the attempt succeeded. The cards and chart show volume, unique attackers, and daily activity.

1

Attempts observed

1

Unique attacker IPs

1

Attacker countries

JP

1

Sensors observed

CVE-2026-97229 exploitation attempts over the last 12 days

Daily events observed by Previdian sensors

Updated 31 Oct 2026

0

1

0

20 Oct 23 Oct 26 Oct 31 Oct

First observed 21 Oct 2026 · Last observed 21 Oct 2026

Pro adds sensor region and window summaries. Enterprise adds raw IPs, paths, User-Agents, and payloads.

Start 14-day Pro trial

Detection

Operational artifacts and observed signals

Make the evidence actionable in scanner, SOC, and edge-control workflows.

Observed signals

Request targets
User-Agents
Callback hosts: 1; 1; 0

Request targets and User-Agents available in Pro. Callback host details available in Enterprise.

Scanner coverage

No scanner integrations recorded yet.

Virtual patch status

No Previdian virtual patch is currently available. Future rules ship for ModSecurity, Cloudflare, and AWS WAF.

Learn about virtual patches →

Risk and context

Severity, weaknesses, and research context

CVSS v3.1

10.0 Critical

Potential damage if exploited. Separate from whether attackers are using it.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS

26.6%

Estimated chance of exploitation in the next 30 days. Previdian's warning comes from evidence, not this score.

Weaknesses

Integer Overflow or Wraparound CWE-190

Recent mention · Security Affairs

30 Oct 2026

U.S. CISA adds GitLab and Cisco flaws to its Known Exploited Vulnerabilities catalog

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds GitLab and Cisco flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added GitLab and Cisco vulnerabilities to its Known Exploited...

Read full advisory

All Mentions

Recent mention · NCSC Security Advisories

NCSC-2026-0414 [1.00] [M/H] Kwetsbaarheden verholpen in GitLab

NCSC Security Advisories · 13 Oct 2026

GitLab heeft kwetsbaarheden verholpen in GitLab Community Edition (CE) en Enterprise Edition (EE), specifiek in versies voorafgaand aan 19.2.8, 19.3.5 en 19.4.2. De kwetsbaarheden zijn aanwezig in verschillende onderdelen van GitLab, waaronder de CI/CD pipelineomgeving, autorisatiemechanismen, API, Kubernetes-integratie en package registry. Kwaadwillenden kunnen de kwetsbaarheden misbruiken voor het uitvoeren van willekeurige code, vergrijken van ongeautoriseerde toegang tot gevoelige gegevens en het uitvoeren van cross-site-scripting-aanvallen. De kwetsbaarheid met kenmerk CVE-2026-97229...

Recent mention · The Hacker News

GitLab Patches CVSS 10.0 Flaw That Could Let Unauthenticated Users Run Server Code

The Hacker News · 13 Oct 2026

Ravie LakshmananOct 13, 2026Vulnerability / DevSecOps GitLab has released patches for a maximum-severity security flaw impacting its Community Edition (CE) and Enterprise Edition (EE) software that could result in arbitrary code execution. "GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation," the company said in a Monday advisory. The flaw, tracked as CVE-2026-97229, has...

Potential Proof of Concepts

These PoCs are unverified and could contain malware. Use at your own risk.

Noshadi-sec/CVE-2026-97229

github · Created 2026-10-26 15:14:45 UTC · 0 stars · AI assessment 82%

CVE-2026-97229 an external exploit for GitLab CI lint regex RCE. It is used only against a live GitLab target with permission. It creates a project, pushes a malicious CI configuration, triggers the CI lint endpoint, and receives command output through an HTTP callback. This is for authorized security research only.

OppositDeer/Gitlab-RCE-CVE-2026-97229

github · Created 2026-10-16 11:10:59 UTC · 1 stars · AI assessment 84%

CVE-2026-97229: GitLab RCE Unauthenticated via CI Lint

CVE-2026-97229 Exploit: GitLab CI Regexp RCE

1dayexploit · Created 2026-10-12 20:30:00 UTC

Integer overflow in GitLab CI/CD regex compiler (CVE-2026-97229) leads to remote code execution affecting CE/EE versions 19.2-19.4. CVSS 10.0.

HackerOne Bug Bounty Report #4058589

cve · Created Unknown

HackerOne Bug Bounty Report #4055749

cve · Created Unknown

Timeline

From disclosure to observed exploitation attempts

30 Oct 2026
21:21 UTC

KEV confirmed by Security Affairs

Exploitation attempts reported by an external source
30 Oct 2026
07:30 UTC

KEV confirmed by The Hacker News

Exploitation attempts reported by an external source
29 Oct 2026
20:01 UTC

Added to CISA KEV

Listed in the CISA Known Exploited Vulnerabilities catalog
13 Oct 2026
02:20 UTC

Added to the Previdian watchlist

Pro and Enterprise Watch users had 2 weeks of early warning before CISA KEV. Also 2 weeks before Previdian KEV.
13 Oct 2026
01:05 UTC

CVE published

Vulnerability disclosed publicly
12 Oct 2026
20:30 UTC

Public PoC available

Public proof-of-concept code published
24 Sep 2026
10:04 UTC

CVE ID reserved

Identifier reserved by the CNA

Pro API

Automate this intelligence

Confidence, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

Start 14-day Pro trial Read API docs

Evidence confidence and provenance
First-party sensor telemetry
PoC and scanner references
Affected versions and enrichment
Automation-ready JSON delivery

GET /api/v2/pro/kevs/CVE-2026-97229

Sample API response

{
  "cve_id": "CVE-2026-97229",
  "confidence": "Confirmed",
  "cvss_score": 10.0,
  "cvss_estimated": false,
  "epss_score": 0.26569,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "attempts": 1, "sensors": 1 }
}

CVE-2026-97229

Integer Overflow or Wraparound in GitLab

Tags

CVE References

Exploitation Attempts Observed in the Wild

Proof of concept available

Known exploited vulnerability sources

Observed signals

Scanner coverage

Virtual patch status

Weaknesses

U.S. CISA adds GitLab and Cisco flaws to its Known Exploited Vulnerabilities catalog

All Mentions

Potential Proof of Concepts

KEV confirmed by Security Affairs

KEV confirmed by The Hacker News

Added to CISA KEV

Added to the Previdian watchlist

CVE published

Public PoC available

CVE ID reserved

Automate this intelligence