https://reddit.com/r/sysadmin/comments/1xjh3a0/selfmanaged_gitlab_cve202697229_cvss_10/: Self-managed GitLab: CVE-2026-97229 (CVSS 10, unauthenticated RCE via crafted CI/CD config) is in CISA KEV, deadline 1 Nov

Self-managed GitLab CE and EE deployments are affected. GitLab.com is already patched.

No. The issue allows code execution on the server through a crafted CI/CD configuration without logging in.

The fixed releases are 19.4.2, 19.3.5, and 19.2.8. Upgrade to the fixed release for your current branch.

Check the installed version in Admin > Dashboard. If it is not on one of the listed fixed releases, upgrade immediately.

Published Oct 30, 2026

Updated

Affected Software

1 affected component

GitLab GitLab CE/EE<19.4.2, <19.3.5, <19.2.8

Self-managed GitLab CE and EE deployments are affected. GitLab.com is already patched.

No. The issue allows code execution on the server through a crafted CI/CD configuration without logging in.

The fixed releases are 19.4.2, 19.3.5, and 19.2.8. Upgrade to the fixed release for your current branch.

Check the installed version in Admin > Dashboard. If it is not on one of the listed fixed releases, upgrade immediately.