Self-hosted GitLab users urged to patch RCE and auth flaws in versions 19.2-19.4 immediately

GitLab released critical security updates for its Community Edition (CE) and Enterprise Edition (EE) on October 8, 2026. The vendor published versions 19.4.2, 19.3.4, and 19.2.8 to address multiple security vulnerabilities. According to the official advisory, these patches contain important bug fixes and security remediations. The company strongly recommends that all self-managed GitLab installations upgrade to one of these versions immediately to mitigate risk.

The risk

The most severe issue, identified as CVE-2026-97229, involves an integer overflow in the CI/CD regular expression compiler. According to GitLab, this flaw could allow an unauthenticated user to execute arbitrary code on the server. This occurs when an attacker submits a specially crafted regular expression in a CI/CD configuration. The vulnerability stems from insufficient validation of regular expressions within the system.

Beyond remote code execution, the patch addresses numerous authorization and access control failures. Issues include improper authorization in downstream pipeline creation, incorrect authorization in GraphQL notes and work item hierarchies, and missing authorization in merge request accessibility reports. Other flaws involve permissive regular expressions in repository file access, server-side request forgery in repository imports, and open redirects in the Kubernetes proxy.

Who is exposed

The vulnerabilities impact both GitLab Community Edition and Enterprise Edition. The advisory specifies that when no specific deployment type is mentioned, all types are affected. This includes omnibus, source code, and Helm chart deployments. GitLab.com is already running the patched version, so users of the SaaS offering are protected. GitLab Dedicated customers also do not need to take action.

Cost and compliance

GitLab states that it is committed to ensuring all aspects exposed to customers or hosting customer data meet the highest security standards. The vendor notes that issues detailing each vulnerability are made public on its issue tracker 90 days after the release in which they were patched. This disclosure policy allows organizations to plan upgrades before full technical details become widely available.

What happens next

Self-managed administrators should verify their current GitLab version against the affected list. If running version 19.2, 19.3, or 19.4, an upgrade to the latest patch release is required. Organizations should maintain good security hygiene by upgrading to the latest patch release for their supported version.

What to do and how to stay safe: GitLab

• Check your GitLab instance version and compare it against the affected releases 19.2, 19.3, and 19.4.
• Schedule an immediate upgrade to versions 19.2.8, 19.3.4, or 19.4.2 if you are running a self-managed installation.
• Review access logs for unauthorized attempts to create pipelines or access GraphQL endpoints until the patch is applied.
• Ensure all aspects of GitLab exposed to customers are held to the highest security standards by following vendor best practices.

Step-by-step guide: Vulnerability Prioritization: Fix What Actually Breaks Your Business

General security guidance from the CloudSec Pulse newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which GitLab versions are affected by these vulnerabilities?

Versions 19.2, 19.3, and 19.4 of both Community Edition and Enterprise Edition are affected.

Do SaaS users need to apply this patch?

No, GitLab.com is already running the patched version, and Dedicated customers do not need to take action.

What is the most severe vulnerability in this release?

CVE-2026-97229 is an integer overflow issue that could allow unauthenticated remote code execution.