CVE-2026-97229

Executive Summary

CVE-2026-97229 is a critical remote code execution (RCE) vulnerability in GitLab CE and EE editions affecting all versions starting from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. The flaw allows an unauthenticated attacker to execute arbitrary code on the GitLab server via a specially crafted regular expression embedded within a CI/CD configuration, stemming from insufficient regular expression validation. With a CVSS score of 10.0, this represents a maximum-severity risk requiring immediate attention.

Technical Analysis

The vulnerability class is rooted in insufficient regular expression validation, which allows an unauthenticated user to supply a malicious regex through the CI/CD configuration. According to the NVD description, the flaw is present in GitLab CE/EE and manifests when the server processes a specially crafted regular expression. The CWE associated with this CVE is CWE-190, which is an Integer Overflow or Wraparound. This suggests that the core issue involves improper handling of integer values during regex processing, potentially leading to memory corruption, buffer overflows, or logic that can be exploited to achieve arbitrary code execution. The attack surface is the CI/CD pipeline configuration interface, which is often accessible to some degree by unauthenticated users in certain configurations (e.g., public projects, merge request pipelines, or webhook triggers). The CVSS vector indicates network accessibility, low attack complexity, no privileges required, and no user interaction, confirming that an attacker can trigger the flaw remotely without authentication. The scope is changed (S:C), meaning the exploitation can affect resources beyond the vulnerable component's security authority, which is consistent with an RCE that allows full server compromise.

The exact mechanism by which an integer overflow in regex validation leads to code execution is not detailed in the available description, but it likely involves a crafted regex that causes an integer overflow when calculating buffer sizes, match counts, or backtracking limits, ultimately allowing an attacker to corrupt memory and hijack execution flow. GitLab's CI/CD configuration is typically parsed as YAML, and regex patterns can be specified in various keywords (e.g., rules:if with regex comparisons, or only/except with regex). An unauthenticated attacker could potentially push a branch or create a merge request to trigger a pipeline that evaluates the malicious regex, or the CI/CD configuration might be evaluated during project import or other metadata processing that is accessible without authentication.

The lack of specific details about the vulnerable code path, function names, or file paths in the NVD description prevents a more granular code-level explanation. However, the vulnerability class—integer overflow in regex validation—is well-known in other contexts and often leads to heap corruption, stack buffer overflows, or denial of service. The fact that it leads to arbitrary code execution indicates that the overflow can be exploited for memory corruption that is controllable by the attacker, likely through a regex that manipulates integer arithmetic in the regex engine.

Exploitation Scenarios

No public proof-of-concept (PoC) is available, and the exploit code is not known. The attack chain is inferred from the vulnerability class and the description provided.

1. Reconnaissance and Target Identification: An attacker identifies a GitLab instance running an affected version (19.2 before 19.2.8, 19.3 before 19.3.5, or 19.4 before 19.4.2). This can be done via Shodan dorks such as http.title:"GitLab" or by scanning for the GitLab web interface. The attacker needs to determine if the instance allows unauthenticated users to trigger CI/CD pipelines, which can be the case for public projects where anyone can create a merge request, or if the instance has public snippets that can be imported.

2. Triggering the Flaw: The attacker crafts a malicious regular expression and embeds it into a CI/CD configuration file (e.g., .gitlab-ci.yml). The specific location where the regex is processed is not detailed in the description, but the attacker would likely place it in a context that is evaluated during pipeline creation or job execution. For instance, they might use a rules:if clause with a regex pattern that triggers the integer overflow. Alternatively, the attacker might exploit a feature that allows unauthenticated users to submit a CI/CD configuration, such as through a public project's merge request pipeline or a repository mirroring feature.

3. Payload Execution: The malicious regex causes an integer overflow (CWE-190) within GitLab's regex processing logic. This overflow leads to memory corruption, which the attacker can leverage to execute arbitrary code. The exact payload would depend on the memory layout and the nature of the overflow, but it could involve overwriting a return address or function pointer to redirect execution to attacker-controlled shellcode. Since the CVSS vector indicates no privileges required, the attacker can achieve this without any authentication, making it extremely dangerous.

4. Post-Exploitation Impact: Successful exploitation grants the attacker arbitrary code execution on the GitLab server, typically with the privileges of the GitLab application user (often git or gitlab-www). This allows the attacker to read, modify, or delete sensitive data, including source code, CI/CD secrets, and user credentials. They could also pivot to other systems, install backdoors, or use the server as a launchpad for further attacks. The scope change (S:C) indicates that the compromise can extend beyond the GitLab application to the underlying operating system and network.

It is important to note that the exact steps may vary based on the specific implementation of the regex validation and the CI/CD pipeline processing. Without a public PoC or detailed technical write-up, the above scenario is a high-level reconstruction based on the vulnerability class and the limited information available.

Impact Assessment

The impact of CVE-2026-97229 is severe, as indicated by its CVSS score of 10.0. The CVSS subscores are:

• Confidentiality (C:H): High impact, meaning there is a total loss of confidentiality, with all data on the GitLab server potentially exposed.
• Integrity (I:H): High impact, allowing the attacker to modify any data on the server.
• Availability (A:H): High impact, enabling the attacker to disrupt service or destroy data.
• Scope (S:C): Changed, indicating that the vulnerability can affect resources beyond the vulnerable component, such as the underlying operating system.
• Attack Vector (AV:N): Network-based, exploitable remotely.
• Attack Complexity (AC:L): Low, meaning no special conditions are required for exploitation.
• Privileges Required (PR:N): None, so no authentication is needed.
• User Interaction (UI:N): None, so the victim does not need to perform any action.

The business impact includes potential full compromise of the GitLab instance, leading to data breaches, intellectual property theft, supply chain attacks (since GitLab often hosts source code and CI/CD pipelines), and regulatory compliance violations. The blast radius is extensive: any organization using an affected GitLab version is at risk, and because the vulnerability can be exploited unauthenticated, it is a prime target for automated scanning and exploitation by both opportunistic and sophisticated threat actors.

Detection Guidance

Sigma Rule

title: GitLab CI/CD Regex RCE Attempt (CVE-2026-97229)
id: 6a4b3c2d-1e5f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to exploit CVE-2026-97229 via crafted regular expressions in GitLab CI/CD configuration files.
author: Threat Intelligence Team
date: 2026-05-20
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith:
            - '/ruby'
            - '/gitlab-workhorse'
            - '/gitlab-rails'
        CommandLine|contains:
            - 'Regexp.new'
            - 'regexp'
            - 'ci/config'
    condition: selection
falsepositives:
    - Legitimate CI/CD pipeline executions with complex regex
level: high
tags:
    - attack.t1190
    - cve.2026.97229

YARA Rule

rule CVE_2026_97229_GitLab_Regex_RCE
{
    meta:
        description = "Detects potential exploitation of CVE-2026-97229 in GitLab CI/CD configs"
        author = "Threat Intelligence Team"
        date = "2026-05-20"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-97229"
        hash = "unknown"
    strings:
        $regex1 = /Regexp\.new\s*\(\s*[\"'].*[\"']\s*\)/ nocase
        $regex2 = /ci\/config\/.*regex/ nocase
        $int_overflow = /(\d{10,}|0x[0-9a-f]{8,})/ nocase
    condition:
        any of them
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-97229 GitLab CI/CD Regex RCE Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/api/"; http_uri; content:"ci"; http_uri; content:"config"; http_uri; pcre:"/regexp|Regexp\.new|\.gitlab-ci\.yml/i"; classtype:attempted-admin; sid:10000001; rev:1;)

Elastic Detection

process where process.name in ("ruby", "gitlab-rails", "gitlab-workhorse") and process.args : ("*Regexp.new*", "*regexp*", "*ci/config*")

Splunk SPL Query

index=gitlab sourcetype=gitlab:production
| search "Regexp.new" OR "regexp" OR "ci/config"
| stats count by host, user, process, _time
| where count > 0

Wazuh OSSEC Rule

<group name="gitlab,">
  <rule id="100001" level="12">
    <decoded_as>json</decoded_as>
    <field name="message">Regexp.new|regexp|ci/config</field>
    <description>CVE-2026-97229: Potential GitLab CI/CD Regex RCE attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix or workaround is currently documented.

1. Immediate Mitigations:

   • Isolate the GitLab instance from untrusted networks and restrict public access to CI/CD features.
   • Disable unauthenticated CI/CD pipeline triggers, such as public project pipelines or merge request pipelines from forks, if possible.
   • Monitor for anomalous regex patterns in CI/CD configurations and audit logs for unexpected pipeline executions.
   • Apply virtual patching at the WAF level to block requests containing suspicious regex patterns in CI/CD configuration payloads, though this is challenging due to the complexity of regex.

2. Patch/Upgrade Steps:

   • Although no patch is available, GitLab has stated that the issue is remediated in versions 19.2.8, 19.3.5, and 19.4.2. Organizations should upgrade to these versions or later as soon as they are released. Until then, there is no official fix.
   • Monitor GitLab's security advisories and official channels for updates.

3. Long-term Hardening:

   • Implement strict validation and sanitization of all user-supplied regular expressions, including limiting regex complexity and length.
   • Use isolated execution environments for CI/CD runners, such as containers with minimal privileges, to contain any exploitation attempts.
   • Enforce the principle of least privilege for the GitLab application user and related services.
   • Regularly review and update CI/CD pipeline configurations, and limit the ability of unauthenticated users to influence pipeline execution.
   • Conduct security training for developers on the risks of regex injection and integer overflows.

References

1. NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-97229
2. GitLab Security Advisories: https://about.gitlab.com/security/
3. CWE-190: Integer Overflow or Wraparound: https://cwe.mitre.org/data/definitions/190.html
4. MITRE ATT&CK T1190: https://attack.mitre.org/techniques/T1190/
5. GitLab CI/CD Security Documentation: https://docs.gitlab.com/ee/ci/security/