> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # CISA KEV adds critical GitLab RCE and Cisco DoS flaws - URL: https://f4n6.co.uk/security-feed/cisa-kev-adds-critical-gitlab-rce-and-cisco-dos-flaws/ - Published: 2026-10-30T09:45:19.000Z - Updated: 2026-10-30T09:45:19.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2026-97229 ## 1\. Executive summary CISA added CVE-2026-97229, an integer overflow in GitLab Community Edition and Enterprise Edition, to its Known Exploited Vulnerabilities catalog on 2026-10-29, citing evidence of active exploitation. The flaw is rated CVSS 10.0 critical (CWE-190) and carries an EPSS score of 18%. It allows an unauthenticated user to execute arbitrary code on a GitLab server through a specially crafted regular expression in a CI/CD configuration, and it affects self-managed instances from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2\. Any EMEA financial services firm running a self-managed GitLab instance that permits users to create public projects is exposed to remote code execution on a system that typically holds source code, CI/CD secrets and pipeline credentials. The KEV remediation due date is 2026-11-01, two days from issue. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 17 | A KEV-listed remote code execution flaw in a self-managed CI/CD platform that holds source code and pipeline secrets requires an incident management process able to detect and respond to compromise of that platform, not only to patch it. | Firms must be able to evidence a defined detection and response process for the GitLab instance, including who triages anomalous pipeline activity and how containment is executed. | | DORA Art. 19 | Active exploitation is confirmed by CISA (KEV addition 2026-10-29); if a self-managed instance is compromised, the event is a candidate major ICT-related incident requiring reporting to competent authorities. | The 2026-11-01 KEV deadline compresses the window in which a compromise could be detected before a reporting obligation is triggered; reporting timelines run from classification, so detection speed matters. | | NIS2 Art. 23 | Same trigger: confirmed active exploitation of an internet-reachable RCE in an essential or important entity's CI/CD platform. | Where the entity falls in NIS2 scope, a compromise of the GitLab server is a reportable incident; the KEV listing is the evidence that exploitation is occurring in the wild. | ## 3\. Technical analysis & attack chain The vulnerability is an integer overflow or wraparound (CWE-190) in GitLab's CI/CD Regular Expression Compiler. Insufficient validation of a regular expression supplied in a CI/CD configuration lets an unauthenticated user reach arbitrary code execution on the GitLab server. GitLab fixed it in 19.4.2, 19.3.5 and 19.2.8, released 2026-10-12\. GitLab.com already runs the patched version and GitLab Dedicated customers need take no action; the exposure is self-managed instances. Confirmed steps, from Rapid7's reproduction against an unpatched official GitLab CE 19.4.1 image (the same input failed against patched 19.4.2): 1. The attacker needs an account able to commit to a branch in a public project on the self-managed instance. Rapid7 found an ordinary account meets this where the instance allows users to create public projects. 2. The attacker commits a malicious CI/CD configuration file, `.gitlab-ci.yml`, containing a specially crafted regular expression. 3. The attacker also needs a repository path containing UTF-8 characters. 4. The CI/CD Regular Expression Compiler processes the crafted expression, the integer overflow occurs, and code executes on the GitLab server. The vendor CVSS vector describes the flaw as remotely exploitable with low complexity and no privileges or user interaction. Rapid7's reproduction qualifies that: the attacker must first be able to commit the malicious `.gitlab-ci.yml` and a UTF-8 repository path to a branch in a public project. On instances that restrict public project creation, that precondition is not met by an ordinary account. Treat the CVSS 10.0 rating as authoritative for severity while accounting for the commit precondition in exposure assessment. The source does not describe post-exploitation behaviour, persistence, command-and-control, lateral movement or data access for this CVE. No malware family, tooling or exfiltration channel is named. What executes is arbitrary code in the context of the GitLab server process, and the server holds source code, CI/CD variables and pipeline credentials, so the impact ceiling is compromise of everything the instance can reach. That is an inference from what a GitLab server holds, not an observed capability in the source. Attribution is unconfirmed. No threat actor is named in the source material and no MITRE ATT&CK profile applies. CISA's KEV entry records known ransomware campaign use as unknown. One discrepancy to note: Rapid7's October 13 reproduction stated there was no confirmed in-the-wild exploitation at that time. CISA's 2026-10-29 KEV addition cites evidence of active exploitation. The KEV state is authoritative and postdates the Rapid7 note. ## 4\. Mitigation & containment ### P1 (within 24 hours) - Upgrade every self-managed GitLab instance to 19.4.2, 19.3.5 or 19.2.8\. This is the vendor fix and closes the flaw; the KEV due date is 2026-11-01\. Do not wait for the normal patch cycle. - Inventory self-managed instances and confirm which permit users to create public projects. Those are the instances where Rapid7's precondition is met by an ordinary account and should be patched first. - Where an instance cannot be patched immediately, restrict public project creation and review existing public projects for unexpected `.gitlab-ci.yml` commits and repository paths containing UTF-8 characters. - Search GitLab audit and CI logs for pipeline runs triggered by `.gitlab-ci.yml` changes from accounts or branches that should not have them, and for repository paths with UTF-8 characters created recently. ### P2 (within 72 hours) - Rotate CI/CD variables, runner registration tokens and any credentials stored in the GitLab instance that was exposed before patching, on the assumption that code execution could have read them. - Review GitLab server hosts for unexpected processes, outbound connections and new scheduled jobs or services created since 2026-10-12, the patch release date. ### P3 (within 7 days) - Add a control that blocks or alerts on public project creation on self-managed instances unless there is a documented business need. - Confirm GitLab Dedicated and GitLab.com users need no action, and record that in the patch evidence trail. ## 5\. Indicators of compromise No indicators of compromise available in the source material. The source describes a vulnerability and a reproduction, not an observed intrusion, and gives no hashes, domains, IP addresses or file artefacts. Behavioural indicators: | behaviour | where to observe | confidence | | ---------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------- | --------------------------------------------------- | | Commit of a .gitlab-ci.yml containing a crafted regular expression to a branch in a public project | GitLab audit events, repository commit history, CI pipeline logs | Medium (from Rapid7 reproduction, single-sourced) | | Repository path containing UTF-8 characters created alongside the malicious commit | GitLab project and repository metadata | Medium (from Rapid7 reproduction, single-sourced) | | Pipeline execution on an unpatched instance followed by unexpected code execution in the GitLab server process context | GitLab server host process telemetry, EDR | Low (inferred precondition, not observed in source) | ## 6\. Detection Insufficient indicators to author detection rules. The source gives no distinctive strings, command-line flags, file names, registry keys or network artefacts belonging to an exploit or payload. The only named file, `.gitlab-ci.yml`, is a legitimate GitLab configuration file present in normal repositories and is not specific to the threat. A rule built on it would match ordinary CI activity, not exploitation. ## CVE assessment 1 referenced CVE — **1 actively exploited (CISA KEV)**, 1 critical (CVSS ≥ 9.0) | CVE | CVSS | Exploited | EPSS | Summary | | -------------------------------------------------------------------------------- | ------------- | ---------------- | ---- | -------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2026-97229](https://nvd.nist.gov/vuln/detail/CVE-2026-97229?ref=f4n6.co.uk) | 10.0 Critical | ⚠ KEV 2026-10-29 | 18% | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 bef… | ## 7\. Sources - The Hacker News, "CISA Adds Actively Exploited GitLab RCE and Cisco Firewall DoS Flaws to KEV", 2026-10-30\. https://thehackernews.com/2026/10/cisa-adds-actively-exploited-gitlab-rce.html - NVD / CISA KEV, CVE-2026-97229, GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability. https://nvd.nist.gov/vuln/detail/CVE-2026-97229 - Help Net Security, "GitLab admins urged to patch critical RCE flaw (CVE-2026-97229)", 2026-10-13\. https://www.helpnetsecurity.com/2026/10/13/gitlab-ci-cd-regular-expression-compiler-vulnerability-cve-2026-97229/ ## 8\. Adverse Trace position Adverse Trace assesses CVE-2026-97229 as CVSS 10.0 critical, CWE-190, in CISA KEV since 2026-10-29 with a remediation due date of 2026-11-01, EPSS 18%, and known ransomware campaign use unknown. The severity is not in question; the exposure question is whether a given self-managed instance allows ordinary users to create public projects, because Rapid7's reproduction shows that precondition gates exploitation. That reproduction is single-sourced; verify the precondition against your own instance configuration before treating an instance as low risk. Attribution is unconfirmed: no actor is named and no MITRE ATT&CK profile applies. We will track KEV additions and vendor advisories for GitLab through the 2026-11-01 deadline and update this advisory if post-exploitation detail or indicators emerge. Clients running self-managed GitLab should confirm patch status to 19.4.2, 19.3.5 or 19.2.8 and report instance counts to their Adverse Trace contact. --- [Read the original source →](https://thehackernews.com/2026/10/cisa-adds-actively-exploited-gitlab-rce.html?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*