GitLab Critical Flaw CVE-2026-97229 Prompts Security Review of CI/CD Pipelines

GitLab has disclosed CVE-2026-97229, a maximum-severity vulnerability rated CVSS 10.0 that could let an unauthenticated attacker run arbitrary code on a vulnerable server via a crafted regular expression in CI/CD configuration. The flaw originates in Onigmo, the regular-expression engine used by Ruby, rather than solely in GitLab's own code. Alpine Linux reported that attackers tried to exploit its GitLab instance on October 20 and 21, about a week after disclosure, and although no successful code execution was found, it rebuilt the instance as a precaution. Organizations running custom Ruby builds or container images must update Ruby separately, as upgrading GitLab alone may not fix the issue. Experts stress that self-managed GitLab instances often hold source code, secrets, and cloud credentials, so a compromise could escalate into a software supply-chain attack.