GitLab patches maximum-severity remote code execution flaw plus 23 other bugs
In short: On 12 October 2026 GitLab shipped versions 19.4.2, 19.3.4 and 19.2.8, closing 24 security holes in self-managed CE/EE. The headline fix is CVE-2026-97229, a CVSS 10.0 bug in the CI/CD regex compiler where weak expression validation causes an integer overflow, letting an unauthenticated attacker craft a CI/CD configuration that executes code on the server. CERT-EU is pushing organisations to patch immediately, with internet-facing GitLab instances first in line.
This summary was generated automatically by AI from CERT-EU's publication. It is our own text, not a copy of the original — facts, figures and quotes belong to the source, linked above and below.
What changed?
- 1CVE-2026-97229 (CVSS 10.0): unauthenticated attacker can achieve code execution via integer overflow in the CI/CD regex compiler
- 2CVE-2026-92883 (CVSS 8.7): stored XSS in syntax highlighting lets an authenticated user run JavaScript in other users' browsers via a crafted repository
- 3CVE-2026-16301 (CVSS 8.5): broken authorization allows a developer to trigger pipelines on protected branches without permission
- 421 more issues fixed, including an 8.2-rated cache poisoning bug that could leak protected CI/CD variables
- 5Vulnerable: self-managed GitLab CE/EE before 19.4.2, 19.3.4 and 19.2.8
- 6Remediation: upgrade to 19.4.2, 19.3.4 or 19.2.8
Why it matters
A perfect-score, unauthenticated RCE in a DevOps platform used to store code, secrets and CI/CD pipelines is a prime target for automated exploitation once a proof-of-concept appears; any internet-facing GitLab server is at immediate risk.
What it means for AI agents and contact centers
If your company self-hosts GitLab CE/EE for source control or CI/CD pipelines — including ones that build or deploy voice AI agents, SIP/Asterisk components, or CRM integrations — patch to the fixed versions now and check whether CI/CD secrets may have been exposed via the cache poisoning bug before patching.
Sources
- CERT-EUOfficialPrimary sourceOriginal article →„2026-016: Critical Vulnerability in GitLab CE and EE“Licence: CC BY 4.0 (CERT-EU legal notice; Commission Decision 2011/833/EU) · our summary (content changed)
- Published by source
- —
- Found by our system
- 12 Oct 2026, 16:10
- Summary generated
- 12 Oct 2026, 16:12
This article was written by AI from the original source. Facts, numbers and prices come from the source; missing values are marked “Not specified”. Legal notice, copyright and privacy