How do I check if my GitLab is vulnerable to CVE-2026-97229?

On your GitLab host run: sudo gitlab-rake gitlab:env:info | grep "GitLab version". Versions 19.2.0-19.2.7, 19.3.0-19.3.4, and 19.4.0-19.4.1 are vulnerable to unauthenticated remote code execution. Upgrade to 19.2.8, 19.3.5, or 19.4.2 (or newer). The free 30-second self-test on this page walks through the exact checks.

Does the attacker really need no account to exploit CVE-2026-97229?

Almost. The exploit needs a malicious CI configuration committed to a repository first, then the CI lint endpoint is triggered without credentials. On GitLab instances with open self-registration, any internet user can plant that config — so treat it as fully unauthenticated. With sign-ups restricted, an attacker still only needs one low-privilege account.

What should I do if my GitLab was exposed to CVE-2026-97229?

Upgrade to 19.2.8 / 19.3.5 / 19.4.2 immediately, outside your normal patch cycle. Rotate everything the application worker could have read: CI/CD variables (masked and protected first), runner registration tokens, personal access tokens, and the Rails secret. Review recent .gitlab-ci.yml commits for regex-heavy changes nobody on your team made, and turn off open registration unless you truly need it.

CVE-2026-97229 — CVSS 10.0 — POC PUBLIC

Is your GitLab server exposed to the CI/CD regex RCE?

A maximum-severity flaw in GitLab's CI/CD regular expression compiler lets an attacker run code on your GitLab server — no login required on instances with open sign-ups. The patch shipped October 12; a working proof-of-concept went public October 13; Censys counts 25,766 internet-facing hosts still on vulnerable versions. This free 30-second self-test tells you if you're at risk. No signup, nothing installed.

The 30-second check

Check your GitLab version — on the host running GitLab:

sudo gitlab-rake gitlab:env:info | grep "GitLab version"

19.2.0–19.2.7, 19.3.0–19.3.4, or 19.4.0–19.4.1 → you are EXPOSED. Unauthenticated RCE via a crafted CI regex. Upgrade now.

Older than 19.2 → not listed in the advisory. No patch exists on your branch — upgrade to a supported release regardless.

19.2.8, 19.3.5, 19.4.2 or newer → patched. You're safe from this CVE.

Check whether open sign-ups make it worse — the exploit needs a malicious CI config committed to a repo before it can be triggered. If anyone on the internet can register on your instance, that barrier is gone:

Admin area → Settings → General → Sign-up restrictions — or on the host:

grep "signup_enabled" /etc/gitlab/gitlab.rb

Sign-ups open → treat this as fully unauthenticated RCE. Any internet user can plant the config. Patch today, not this weekend.

Sign-ups restricted? An attacker still only needs one low-privilege account. Don't relax.

Check for signs of past compromise — the exploit runs inside a GitLab application worker, so a successful hit can read CI/CD variables, secrets, and the database. Hunt for unauthenticated hits on the CI lint endpoint since October 12:

grep "ci/lint" /var/log/gitlab/gitlab-rails/production.log

Also review .gitlab-ci.yml commits from the last two weeks for complex regex you didn't authorize, plus unexpected runner registrations or new admin users. Log review is indicative, not conclusive — patching and compromise-checking are two separate jobs.

If you're exposed, do this now

Upgrade GitLab to 19.2.8 / 19.3.5 / 19.4.2 immediately — outside your normal patch cycle. This is the third regex-engine flaw in GitLab in a month; the component is being actively probed.
Rotate everything the app worker could read — CI/CD variables (masked and protected first), runner registration tokens, personal access tokens, and the Rails secret in gitlab-secrets.json. Patching doesn't un-read secrets.
Turn off open registration unless you truly need it — it's the difference between "needs an account" and "needs nothing".
Review recent pipeline config commits for regex-heavy changes nobody on your team made. The attack arrives as code committed to a repo — a poisoned .gitlab-ci.yml looks innocent until it runs.
A compromised CI server doesn't announce itself — it just starts running the attacker's pipelines. Watch yours.

Scan your repos for poisoned pipeline configs → Vibe-Code Audit

This page checked one CVE. Vibe-Code Audit scans your repositories for malicious code, injected configs, and leaked secrets — the artifacts this attack leaves behind.

Is your GitLab server exposed to the CI/CD regex RCE?

The 30-second check

If you're exposed, do this now

Writing about this CVE? Embed the checker