# GitLab Patches Maximum-Severity CVSS 10.0 Remote Code Execution Vulnerability Critical CI/CD flaw allows unauthenticated remote code execution across self-hosted enterprise servers. - **Source:** [Security Affairs](https://brifing.si/source/e6c4f5ec-3e1b-4152-a932-056243bd56eb) - **Published:** 2026-10-13 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/47fc529e-f838-4ef0-9968-a855516c93e3 ## Maximum Severity Vulnerability Addressed GitLab released urgent security patches to resolve CVE-2026-97229, a critical remote code execution vulnerability carrying a maximum CVSS score of 10.0. The severe flaw allows unauthenticated threat actors to remotely execute arbitrary code on underlying host servers without needing valid credentials or existing system privileges. ## Regex Parser Integer Overflow The critical security vulnerability stems from an integer overflow triggered by weak regular expression validation inside CI/CD configuration files. When parsing specially crafted pattern strings within automated build specifications, the vulnerable regex engine miscalculates buffer allocations, allowing external attackers to escape execution boundaries and take over instances. ## Broad Version Scope Impacted The critical exposure affects both Community Edition and Enterprise Edition self-hosted instances. Specifically, vulnerable deployments span version 19.2 prior to 19.2.8, version 19.3 prior to 19.3.5, and version 19.4 prior to 19.4.2. Security teams must immediately apply these maintenance releases across environments. ## Additional High Severity Exploits GitLab remediated three other high-severity flaws alongside the primary remote code execution bug. These include CVE-2026-92883 with an 8.7 score involving repository script execution, CVE-2026-16301 rated 8.5 for protected branch bypasses, and CVE-2026-14814 rated 8.2 enabling pipeline cache poisoning and credential theft. ## Developer Role Permission Escalation Flaw CVE-2026-16301 breaks branch protection rules by enabling users with standard Developer roles to trigger CI/CD pipelines on protected targets. In enterprise environments, this authorization gap undermines multi-stage change governance and audit boundaries, allowing unauthorized pipeline execution across sensitive production and deployment branches without manager approvals. ## Cache Manipulation and Secrets Leakage Vulnerability CVE-2026-14814 introduces pattern-matching weaknesses in shared CI/CD cache mechanisms. Malicious users can poison persistent pipeline cache layers across project boundaries, forcing downstream builds run by target users to execute arbitrary commands. This attack vector directly risks exfiltrating environment variables and production deployment keys. ## AI Gateway Sandbox Escape These updates follow an earlier fix for CVE-2026-90970, a 9.9 CVSS vulnerability in the AI Gateway. Disclosed on October 2, that bug allowed authenticated users with Duo Agent Platform access to bypass prompt template sandboxes via crafted flow configurations and execute host-level system commands. ## Immediate Remediation Requirements Both vulnerabilities were identified and reported through GitLab's HackerOne bug bounty program by external researchers. Security operations and DevOps teams must verify their running GitLab CE, EE, and AI Gateway versions immediately, prioritizing edge-facing instances to prevent automated exploitation of unauthenticated arbitrary execution vectors. ## Sources covering this story - https://securityaffairs.com/200868/security/gitlab-patches-max-severity-vulnerability-cve-2026-97229.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._