GitLab CVE-2026-97229: the flaw under attack, who it affects and which version to install

What happened, in short

• The flaw: CVE-2026-97229, rated 10 out of 10 by GitLab. It affects GitLab CE and EE and could let an unauthenticated user run code on the server.
• The first patch: released on October 12, 2026 in versions 19.4.2, 19.3.5 and 19.2.8.
• The second patch: released on October 21 for CVE-2026-110264, also rated 10, which affects versions from 7.0 onward. Anyone who stopped at the October 12 patch is still exposed to this one.
• Real attempts have been reported: Alpine Linux reported attempts against its instance on October 20 and 21, plus blocked retries on October 25 and 26. CISA added the flaw to its catalog on October 29.
• GitLab.com and GitLab Dedicated: no action needed. This is for self-managed installations.

Fixed versions

These are the October 21 versions, which cover both flaws. Any later version of the same branch works too. If you are on an old branch, follow GitLab’s required upgrade stops and plan a window: some upgrades migrate the database and can cause downtime on single-node installations.

Is my GitLab exposed?

If it is self-managed and not on a version from the table, you need to update. What changes is the urgency:

• Top urgency: reachable from the internet, with public projects and open sign-up. Rapid7 explains that the attack it demonstrated needs the ability to push changes to a public project, and that open sign-up all but removes that barrier.
• High urgency: reachable from the internet, even with sign-up closed. A contractor or former employee account that is still active may be enough.
• Lower urgency, but still update: only reachable through a VPN or internal network. Restricting access reduces exposure but does not remove the flaw.

How to check, depending on where it runs

• Web console: sign in as an administrator, open the Admin area and read the version on the main dashboard.
• Server with the official package (EC2 or VPS): run sudo gitlab-rake gitlab:env:info and compare with the table.
• Containers (Docker, ECS, EKS): check the tag of the image that is actually running, not the one in your deployment file.
• The ones nobody remembers: test servers, installations run by a team or a vendor, and old copies. Look through every AWS account and region before closing the issue.

What to do, in order

1. 1. Update to a version from the table. GitLab did not publish a workaround for CVE-2026-97229, so this is the fix.
2. 2. If you cannot update today, limit access with the security group to your VPN or office, turn off open sign-up and stop untrusted users from creating or writing to public projects. This lowers the risk but does not fix it.
3. 3. Look for signs of intrusion: unexpected child processes of Puma, new files owned by the git user in /tmp, and changes to that user’s crontabs or SSH keys. GitLab has also published detections for this flaw.
4. 4. If you find something, rotate the contents of gitlab-secrets.json, CI/CD variables, and runner and access tokens, and review pipelines and repositories for changes.

If your GitLab deploys to AWS

The risk does not end at the server. CI/CD variables, runner tokens and deploy keys often lead to production. Three things to check:

• AWS keys in CI/CD variables. If your server was exposed without the patch, treat them as compromised: rotate them and review their use in CloudTrail.
• What those keys can do. A deploy key should not be able to administer the whole account.
• Long-lived keys. GitLab can assume AWS roles with OIDC and temporary credentials, with no fixed keys stored.

Frequently asked questions