Affected Systems
GitLab Community Edition (CE) and Enterprise Edition (EE) versions prior to 19.4.2, 19.3.5, and 19.2.8. Approximately 2,800 Internet-exposed GitLab CE instances tracked. Affects CI/CD Regular Expression Compiler component.
Exploitation Status
Active exploitation confirmed by CISA. Added to KEV catalog October 30, 2026. GitLab has detected exploitation attempts and released threat detections for self-managed instances.
Business Impact
Unauthenticated remote code execution on GitLab servers via malicious regex in CI/CD pipeline configuration. Integer overflow weakness allows arbitrary code execution without authentication. GitLab is used by over 50% of Fortune 100 companies with 70+ million users. Attackers can gain full server compromise, access source code, credentials, secrets, and CI/CD pipelines. Federal agencies under BOD 26-04 must patch by November 2, 2026.
Urgency
🔴 Immediate
Recommended Actions
- Immediately upgrade GitLab CE/EE to version 19.4.2, 19.3.5, or 19.2.8 depending on your release track
- Review GitLab access logs and CI/CD pipeline execution logs for suspicious regex patterns or unexpected pipeline runs since early October 2026
- Deploy GitLab-provided threat detections for self-managed instances to identify exploitation attempts
- Audit all CI/CD configuration files (.gitlab-ci.yml) for unusual or obfuscated regular expressions
- If immediate patching is not possible, restrict network access to GitLab instances to trusted IP ranges and disable unauthenticated access to CI/CD features