The facts
The integer-overflow flaw affects Community and Enterprise editions: 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. [2]
Rapid7 independently reproduced code execution. Although the trigger is unauthenticated, an attacker needs a way to place a malicious CI/CD configuration in a repository; permitted self-registration and project creation can provide that access. [3]
GitLab recommends upgrading self-managed installations to patched releases. It says GitLab.com and GitLab Dedicated are patched. [2]
CISA lists 1 November as the remediation date and requires applicable risk-based patching and forensic-triage guidance. Its binding directive applies to US federal civilian executive agencies, not every user worldwide. [1][4]
Still unconfirmed
- The catalog does not establish the attackers, victim count, exploitation scale or use in ransomware campaigns.
Sources
References support the numbered facts above. Source checks: 29 Oct 2026, 19:56 UTC.
- Known Exploited Vulnerabilities catalog, 29 October 2026 release
CISA · Primary source · 29 Oct 2026
Read the actual CVE-2026-97229 entry, including date added, required action, due date and forensic-triage field.
- GitLab Critical Patch Release: 19.4.2, 19.3.5, 19.2.8
GitLab · Primary source · 12 Oct 2026
Vendor bulletin and current detection guidance read. Fixed versions refer specifically to CVE-2026-97229.
- CVE-2026-97229: Critical unauthenticated remote code execution in GitLab
Rapid7 · Reporting · 13 Oct 2026
Independent technical reproduction and prerequisites read. Its 16 October exploitation assessment predates CISA's 29 October listing.
- BOD 26-04: Prioritizing Security Updates Based on Risk
CISA · Primary source · 10 Jun 2026
Directive scope and exposure-based requirements read; the catalog date is not represented as a universal legal deadline.