GitLab: an exploited flaw calls for a server update and exposure review

Three branches, three fixes

GitLab’s CNA description in NVD covers 19.2 versions before 19.2.8, 19.3 before 19.3.5 and 19.4 before 19.4.2. The record’s CPE boundaries agree for Community and Enterprise editions. Do not treat 19.2.8 as a threshold for every branch: a numerically higher 19.4 release can still be affected.

CI/CD configuration defines how integration and deployment jobs run. Insufficient validation of a regular expression can allow code execution on the server here. The authorized sources we read do not explain every prerequisite; we do not fill that gap with an exploit recipe.

The NVD configurations read on 3 November also name Ruby: branch 3.3 before 3.3.13, 3.4 before 3.4.12 and 4.0 before 4.0.8. The same record’s description still concerns the GitLab CI/CD flaw. These inventory entries establish neither which Ruby version a particular GitLab package bundles nor how its fix is propagated there. Do not replace the GitLab update and exposure review with a runtime scanner’s result alone.

Scroll the table sideways to read every column.

Patching does not settle whether an intrusion occurred

KEV identifies known exploitation and calls for forensic triage for this CVE. Its 1 November 2026 date belongs to the US federal obligations CISA references; it is not a universal legal deadline. For an exposed instance, the practical priority is to patch and review the exposure period rather than wait for that date.

Preserve available logs and an independent recovery path before making changes. Ask the service owner to confirm the fixed branch and review outcome. A version scan or successful update does not establish that no compromise occurred. These are SecuFocus recommendations; we inspected no instance.

• Self-hosting: plan maintenance and recovery↗

Another flaw changes the update target

CERT-FR advisory CERTFR-2026-AVI-1427, published on October 30, adds a separate issue: CVE-2026-111943, a security-policy bypass in GitLab CE/EE and AI Gateway. Its newer patch bounds are listed below. This advisory does not establish active exploitation of that second CVE; do not transfer the KEV status of CVE-2026-97229 to it.

NVD describes this identifier as a Go crypto/x509 certificate-verification fix, not another CI/CD code-execution flaw. The table below copies CERT-FR’s product bounds; we have not traced that dependency fix through the GitLab packages.

For each installed component, compare its own branch and complete version. Updating CE/EE does not establish that a separately operated AI Gateway is patched. These newer bounds do not remove the need to investigate the earlier exploited flaw. We have not installed these releases, and the GitLab vendor bulletin is outside this watch’s authorised source list.

Scroll the table sideways to read every column.