CVE-2026-97229 GitLab RCE: A Perfect-10 Flaw Already Under Attack

CVE-2026-97229 is a maximum-severity, unauthenticated remote code execution vulnerability in GitLab's CI lint regex engine, rated CVSS 10.0 and confirmed as actively exploited in the wild. It has been added to CISA's Known Exploited Vulnerabilities catalog, public proof-of-concept exploit code is circulating, and patching GitLab alone does not fully remediate it.

Key takeaways

• CVE-2026-97229 is an unauthenticated, CVSS 10.0 remote code execution flaw caused by an integer overflow in the regex compiler GitLab's CI lint endpoint relies on.
• The vulnerability is on CISA's Known Exploited Vulnerabilities list and public proof-of-concept exploit code already exists for anyone who wants to try it.
• The vulnerable code actually lives in the Ruby Onigmo regex library, so a GitLab application patch without a Ruby/OS package patch still leaves the server exposed.
• Alpine Linux, whose builds ship the affected Ruby packages, responded to a hacking attempt by rebuilding infrastructure from scratch rather than trusting its own logs, a decision worth studying.

What is CVE-2026-97229?

CVE-2026-97229 is a remote code execution vulnerability in self-hosted GitLab that requires no authentication to exploit. SecPod's analysis and Penligent's technical breakdown both describe the root cause as an integer overflow in the regex compiler that GitLab's CI lint feature uses to validate pipeline configurations.

The exploit path is almost comically simple for something this severe. Public proof-of-concept code from one GitHub researcher and a second independent repository both show the same pattern: create a project, push a malicious CI configuration, hit the CI lint endpoint, and collect command output over an HTTP callback. No credentials needed. The regex engine does the hard work for the attacker.

Orca Security summed it up plainly: unauthenticated attackers can execute code directly on GitLab servers. There is no login wall to get past, which is exactly what makes a CI lint endpoint such an elegant place to hide a perfect 10.

Why did CVE-2026-97229 land on the CISA KEV list so fast?

CVE-2026-97229 was added to CISA's Known Exploited Vulnerabilities catalog because confirmed in-the-wild exploitation followed disclosure within weeks, not months. A dev.to technical writeup documented active exploitation, and Tech Insider's coverage confirmed the KEV addition alongside the CVSS 10.0 score.

The pattern is familiar to anyone who tracks GitLab advisories: Cyber Kendra reported the initial patch within days of disclosure, and a public PoC followed shortly after, which is usually the point where "patch when convenient" stops being an option. Rapid7's technical analysis of the regex overflow mechanics gives defenders the detail needed to understand what exploitation traffic actually looks like at the network layer, which matters more here than usual.