GitLab 10.0: check your own server

What is confirmed

CVE-2026-97229 has a CVSS 3.1 score of 10.0. It concerns regular expressions in CI/CD and may, under certain conditions, allow unauthenticated code execution. CERT-SE reports that it has been added to CISA KEV. [1, 2]

Versions to check

GitLab lists 19.2 before 19.2.8, 19.3 before 19.3.5 and 19.4 before 19.4.2. These are the fixed releases in the advisory. Choose a currently supported target release and follow GitLab's upgrade path. The information applies to GitLab CE/EE. [1]

Our recommended action

Handle any suspected compromise separately from the update.

1. Confirm the installed version and how the service is exposed.
2. Check backup and recovery for data and configuration.
3. Follow the supported upgrade path and test project access and pipelines.
4. Review logs and accounts. If compromise is suspected, assess exposed secrets and the correct order for recovery and replacement.

After the update: three useful tests

We recommend recording the tests in the change ticket. If a test fails, stop further rollout and follow the planned troubleshooting or recovery process.

1. Check GitLab's reported version and that the intended fixed release, or a verified later fixed release, is running.
2. Test an ordinary user sign-in and access to a designated test project.
3. Test a harmless Git workflow and a controlled test pipeline without triggering a live production deployment.

Need a common workflow?

The guide “A vulnerability has been found – take it through to a verified fix” explains how to check whether you are affected, prepare recovery and verify the result.