GitLab CVE-2026-97229: the forgotten server problem

What happened

CVE-2026-97229 is a vulnerability in GitLab's CI/CD regular-expression handling, scored the maximum CVSS 10.0. It allows unauthenticated remote code execution: an attacker who can reach a vulnerable self-managed GitLab instance over the network can run code on it without logging in.

GitLab released fixes on October 12, 2026: versions 19.4.2, 19.3.4 (with 19.3.5 the recommended target on the 19.3 branch) and 19.2.8. A public proof of concept followed on October 13 from Rapid7, and active probing for vulnerable instances has been reported since. Censys counted roughly 25,000 internet-facing vulnerable hosts. If you use GitLab.com, the hosted service, you are already covered: this is a self-managed problem.

Why this shows up at small businesses

GitLab is developer infrastructure, so owners assume it is not their problem. But self-hosted GitLab servers have a way of appearing at small businesses: a contractor set one up for a custom project in 2021, an in-house developer who has since left installed one on a spare VPS, an agency handed over "the server" with everything still running on it. Those forgotten instances are exactly what internet-wide probing finds, because nobody is watching them, let alone patching them.

What to do

• Find out if you run GitLab anywhere. Check old invoices for VPS or server hosting, and ask whoever built your custom software where the code lives.
• If you have a self-managed instance: update now to 19.4.2, 19.3.5 or 19.2.8 (or newer).
• After patching, review recent CI/CD configuration changes for regular expressions nobody recognizes.
• If the instance exists but nobody maintains it, decide: either someone owns patching it, or the code moves to a hosted service and the server gets retired. A server nobody owns is a liability, not an asset.

Where we come in

We find forgotten infrastructure for a living: it is usually the same discovery work as finding the busywork. If you suspect there is a server out there with your name on it, we will locate it, patch or retire it, and leave you a written record of what runs where. Start with the free check on your public website; the conversation usually surfaces the rest.