GitLab
ProductVulnerabilities
13 CVEs in our records, 1 known exploited (on CISA's KEV list).
- CVE-2026-97229 Exploited added to KEV 29 Oct
Am I affected?
Checked against NVD affected-version data on our server. Nothing you type is stored.
Affected versions
- CVE-2026-97229 from 19.2.0, before 19.2.8 · fixed in 19.2.8
- CVE-2026-97229 from 19.4.0, before 19.4.2 · fixed in 19.4.2
- CVE-2026-97229 from 19.3.0, before 19.3.5 · fixed in 19.3.5
- CVE-2026-16255 from 12.0.0, before 19.3.6 · fixed in 19.3.6
- CVE-2026-16255 from 19.4.0, before 19.4.3 · fixed in 19.4.3
- CVE-2026-16255 from 19.5.0, up to 19.5.0
- CVE-2026-14288 from 17.4.0, before 19.3.6 · fixed in 19.3.6
- CVE-2026-14288 from 19.4.0, before 19.4.3 · fixed in 19.4.3
- CVE-2026-14288 from 19.5.0, up to 19.5.0
- CVE-2026-13319 from 19.5.0, up to 19.5.0
- CVE-2026-13319 from 15.10, before 19.3.6 · fixed in 19.3.6
- CVE-2026-13319 from 19.4.0, before 19.4.3 · fixed in 19.4.3
Threat actors named alongside
Source: RedTeamDaily stories that mention bothSecurity timeline
- Vulnerability reported by BleepingComputerAlpine Linux rebuilds GitLab server after attempted attack on critical flaw
- Vulnerability reported by BleepingComputerCISA says max severity GitLab flaw now exploited in the wild
- Vulnerability reported by Zero Day Initiative BlogGitLab CVSS 10.0 flaw targeted on Alpine Linux server; Ivanti, LiteLLM and UAT-6275 also reported
- Zero-day reported by Canadian Centre for Cyber SecurityCisco warns of actively exploited ASA and FTD VPN flaw CVE-2026-76418
- Vulnerability reported by Rapid7 BlogCritical GitLab flaw CVE-2026-97229 allows code execution and is now on CISA's exploited list
Recent news
Alpine Linux rebuilds GitLab server after attempted attack on critical flaw
Attackers attempted to exploit a critical GitLab vulnerability against Alpine Linux's development infrastructure on 20 to 21 October. Concerned about a possible compromise, the project rebuilt its GitLab server and reset all passwords.
CISA says max severity GitLab flaw now exploited in the wild
CISA reports that attackers have started exploiting a maximum-severity GitLab vulnerability. The flaw was patched earlier this month, so organisations running unpatched GitLab instances are exposed. The article gives no CVE, affected versions or technical details.
GitLab CVSS 10.0 flaw targeted on Alpine Linux server; Ivanti, LiteLLM and UAT-6275 also reported
Alpine Linux said on 28 October that an attacker tried to exploit GitLab flaw CVE-2026-97229 (CVSS 10.0) on its GitLab server a week after the fix was released, with no evidence of success. Roundups also cover actively exploited Ivanti Connect Secure and Windows Shell bugs, LiteLLM gateway flaws fixed in version 1.83.9, and Talos and Recorded Future research on UAT-6275, a Kazakhstan-nexus group targeting CIS governments.
Cisco warns of actively exploited ASA and FTD VPN flaw CVE-2026-76418
Cisco has patched CVE-2026-76418, a high-severity flaw (CVSS 8.6) in the remote access SSL VPN of Secure Firewall ASA and Threat Defense (FTD). An unauthenticated remote attacker can send a crafted request that forces a device reload, causing denial of service. The flaw is being exploited in the wild and has been added to CISA's KEV catalogue, with federal agencies required to remediate by 1 November 2026. Cisco urges immediate updating and offers a temporary mitigation of disabling secondary authentication on the tunnel group list or DefaultWEBVPNGroup.
Critical GitLab flaw CVE-2026-97229 allows code execution and is now on CISA's exploited list
GitLab has fixed CVE-2026-97229, an integer overflow in its CI/CD regular-expression handling that carries a CVSS score of 10.0. A Rapid7 proof of concept showed that an attacker who can commit a malicious CI configuration and a crafted path to a public project can run OS commands as the git user on self-managed instances. CISA added the flaw to its Known Exploited Vulnerabilities catalogue on 29 October 2026, so self-managed administrators should upgrade without waiting for the normal patch cycle.