GitLab releases urgent fixes for a critical pipeline flaw

The official October 12 advisory lists patched versions and urges self-managed installations to upgrade.

Ready to listen

SpeedDownload audio

Synthetic narration of the full report. No device voice installation needed. Refer to the text for names and figures.

Made by Alan

12 October 2026 · 1 min read

Article

Report prepared 13 Oct 2026, 3:37 am IST · Event date shown above

AI illustration

AI-generated editorial illustration of a protected server and disconnected cable. Symbolic artwork, not a GitLab screenshot or evidence of an attack.

Understand this story

ASAL AI

Editorial summary

The official October 12 advisory lists patched versions and urges self-managed installations to upgrade.

Event / development: 12 Oct 2026
Location: Global

Use neural AI on this report

Generate a short AI reading note. First use downloads about 290 MB; slower devices may not support it. Questions stay on your device.

GitLab's October 12 advisory identifies critical flaw CVE-2026-97229 in its CI/CD regular-expression compiler. A crafted pipeline configuration could, under certain conditions, allow unauthenticated server code execution. Its severity score is 10.0.

The official release lists fixes in versions 19.4.2, 19.3.5 and 19.2.8. GitLab says self-managed installations should upgrade immediately; GitLab.com is patched and Dedicated customers need no action. Its advisory explains that 19.3.5 also corrects a merge-request-page bug in 19.3.4.

BleepingComputer independently reported the patch on October 12. The vulnerability concerns development infrastructure that can run build jobs and handle credentials. The reviewed reports do not establish active exploitation of this new flaw. Earlier GitLab vulnerabilities and their attack histories should not be treated as evidence of attacks using this one.