Critical GitLab RCE Exploited in the Wild, Added to CISA KEV List

A critical remote code execution (RCE) vulnerability in GitLab, tracked as CVE-2026-97229, has been confirmed under active exploitation and was recently added to the U.S. Cybersecurity and Infrastructure Security Agency's (CISA) Known Exploited Vulnerabilities (KEV) list. With a maximum CVSS score of 10.0, the flaw poses a severe risk to organizations running vulnerable versions of GitLab Community Edition or Enterprise Edition.

The vulnerability stems from an integer overflow issue that can be triggered by a maliciously crafted regular expression within a GitLab CI configuration. This allows unauthenticated attackers to execute arbitrary code on the underlying server. In response to growing evidence of exploitation, CISA has mandated federal agencies to remediate the flaw by a set deadline.

Attack Attempt Reported by Alpine Linux

• Alpine Linux disclosed an attempted exploitation of CVE-2026-97229 just one week after a patch was made available.
• The attack targeted their public GitLab instance using a malicious regex designed to trigger the RCE.
• No evidence of successful compromise was found following forensic analysis.
• Alpine emphasized the importance of timely patching to prevent similar intrusions.

CISA Flags Vulnerability for Immediate Action

• CVE-2026-97229 has been officially added to CISA’s KEV catalog due to confirmed active exploitation.
• Federal agencies were directed to apply mitigations before a specified remediation date.
• The flaw impacts both GitLab Community Edition and Enterprise Edition installations prior to the patched versions.
• Security teams across sectors are advised to audit exposure and prioritize patch deployment.

Sources

• CISA Adds Actively Exploited GitLab RCE and Cisco Firewall DoS Flaws to KEV
• Attacker Tried to Exploit Alpine Linux’s GitLab via CVSS 10.0 Flaw Its Ruby Left Open