26.10.24 - [Alert] Critical Vulnerability in GitLab CE/EE: Update Self-Managed GitLab Now

A maximum-severity vulnerability has been found in GitLab, widely used for source code management and CI/CD. After PHP and Node.js, this month has brought one serious problem after another in the software that development teams rely on.

What is happening

• CVE-2026-97229 (CVSS 10.0): a flaw in CI/CD regular-expression handling can allow code execution on the server. A fix was released on October 12.
• Proof-of-concept exploit code is already public. According to its author, the attacker needs permission to push a branch to a public project on the affected GitLab instance.
• If you use gitlab.com, you don’t need to do anything. Only self-managed GitLab on your own servers is affected.

What to do now

• Update GitLab to 19.2.8, 19.3.4, 19.4.2 or later.
• Some reports say a second critical flaw (CVE-2026-110264) was fixed on October 21. Always check GitLab’s official security advisories for the latest fixed versions.
• Review settings that let anyone sign up, and who can push to public projects.
• If you host your own AI Gateway, also address a separate flaw fixed on October 2 (CVE-2026-90970, CVSS 9.9) — versions 19.2.4, 19.3.2 and 19.4.1.

About MetAI

MetAI does not use GitLab, so we are not affected.

How MetAI can help

Not sure which GitLab version you run, or can’t afford downtime to update? MetAI can help with:

• Emergency check: we identify the versions of GitLab and other software you run, and whether you are affected.
• Updates and migration: we plan updates that don’t stop your work, and help carry them out.
• Protection going forward: access reviews and ongoing vulnerability monitoring, so you’re ready for the next one.

We keep the latest advisories on our security page. Get in touch for a free 30-minute consultation.

Sources: Rapid7 · CERT-EU · BleepingComputer