GitLab has recently released security updates addressing 24 security vulnerabilities across its GitLab Community Edition (CE) and Enterprise Editions (EE).

The update fixes critical remote code execution flaws in CI/CD Regular Expression Compiler and addresses other flaws like cross-site scripting, authorization bypass, and information disclosure flaws.

Through this blog, we will look at the GitLab security update along with some of the most important flaws fixed, and what organizations should do.

Noteworthy vulnerabilities addressed

The vulnerability was originally discovered by a security researcher via GitLab’s HackerOne bug bounty program.

CVE-2026-97229 (CVSS 10) – Integer Overflow

An integer overflow flaw in GitLab that could allow an attacker to trigger incorrect memory allocation when processing specially crafted input.  It could enable arbitrary code execution and cause memory corruption on the affected server.

An attacker can exploit the flaw to:

• Execute arbitrary code on the affected server.
• Compromise the server’s integrity, confidentiality, and availability.
• Interfere with CI/CD operations.
• Access sensitive data.

CVE-2026-92883 (CVSS 8.7) – Cross-site scripting (XSS)

A cross-site scripting flaw in GitLab’s repository syntax that could allow an attacker to inject malicious JavaScript into the repository content. It may execute the malicious script in the user’s browser session when another user views the crafted content.

An attacker can exploit the flaw to:

• Steal sensitive information from the victim’s session.
• Perform unauthorized actions using the victim’s privileges.
• Cause a compromise of user sessions.
• Access information available in the affected account.

CVE-2026-16301 (CVSS 8.5)

An authorization bypass flaw in GitLab that could allow a user with the Developer role to run CI/CD pipelines on protected branches without needing authorization. It weakens branch protection controls intended to restrict pipeline execution.

An attacker can exploit the vulnerability to:

• Run unauthorized CI/CD pipelines on protected branches.
• Bypass security controls that govern software build and deployment workflows.
• Cause a compromise of code integrity.
• Introduce malicious changes to code through unauthorized pipeline execution.

CVE-2026-14814 (CVSS 8.2)

A repository file-access flaw involving cache poisoning that could allow an attacker to manipulate cached repository content and expose protected CI/CD variables.

An attacker can exploit the vulnerability to:

• Access protected CI/CD variables.
• Expose sensitive credentials or other pipeline secrets.
• Target software development and deployment workflows using compromised secrets.

SharkStriker’s recommendations

• Immediately upgrade affected self-managed GitLab installations to the applicable patched version.
• Prioritize internet-facing GitLab servers.
• Verify that CI/CD configurations and repository changes are authorized.
• Review CI/CD pipeline execution and protected-branch activity for suspicious or unauthorized changes.
• Monitor GitLab audit logs and server telemetry for anomalous activity.
• If exploitation is suspected, investigate potential exposure of CI/CD secrets, access tokens, repository credentials, and connected infrastructure.

SharkStriker’s actions

• Vulnerability intelligence reviewed using the official GitLab patch release.
• Critical RCE and additional security fixes identified for prioritization.
• Detection engineering recommended to review monitoring coverage for suspicious CI/CD configuration changes and unauthorized pipeline execution.
• Threat hunting recommended for potentially affected self-managed GitLab environments.