CISA says GitLab flaw is being exploited in the wild
Oct 30, 2026 · Summarized by Fundy Tech from 2 sources
CISA added GitLab CVE-2026-97229 to its exploited list after evidence of active attacks. GitLab urges admins to patch immediately.
Key points
- GitLab fixed CVE-2026-97229 in CE and EE versions 19.4.2, 19.3.5, and 19.2.8.
- CISA added the flaw to its KEV Catalog and ordered federal fixes by Sunday.
- Alpine Linux said an attack against its GitLab instance failed, but it rebuilt the system.
Why it matters
Businesses running GitLab should treat this as urgent. A successful attack could let a remote user run code on the server. For households, the direct risk is lower unless you use a service built on vulnerable GitLab systems. The broader takeaway is that exposed developer tools can become an entry point into company networks.
Who’s affected: GitLab Community Edition and Enterprise Edition users
What to do
- Update GitLab to a fixed version immediately.
- Check for signs of exploitation on self-managed instances.
- Treat the flaw as urgent even if you are outside government.
Vulnerability IDs
Original reporting
Not sure if this affects you?
Fundy Tech helps businesses and households across Atlantic Canada stay patched, protected and up to speed. Tell us what you’re running and we’ll tell you straight whether you need to act.