13 October 2026
Reference: CVE-2026-97229
1. What is being reported?
The report is about a critical bug in GitLab versions before certain updates. This bug allows someone who is not logged in to run any code they want on the GitLab server by exploiting a problem with how GitLab checks certain settings. This could let attackers take control of the server.
2. What this means in plain English
If your organisation uses GitLab to manage software or projects, this vulnerability could let hackers access your systems remotely and cause serious damage, such as stealing data or disrupting services. Even if you do not use GitLab directly, if your IT provider uses it on your behalf, you could still be at risk.
3. Could this affect a small business?
Small businesses or charities that use GitLab Community or Enterprise editions, especially versions before the fixed updates, are at risk. Organisations not using GitLab or using fully updated versions are unlikely to be affected.
4. What to do now
- Check if your organisation uses GitLab and identify the version installed.
- If you use GitLab versions before 19.2.8, 19.3.5, or 19.4.2, arrange to update to the latest fixed version immediately.
- If you do not manage GitLab yourself, ask your IT provider or software supplier about this vulnerability and confirm they have applied the necessary updates.
- Review your server logs and monitor for any unusual activity related to GitLab.
5. Ask your IT provider
Can you confirm whether our GitLab installation is affected by CVE-2026-97229 and if the latest security updates have been applied to prevent unauthenticated remote code execution?
6. Bottom line
Make sure your GitLab software is up to date to prevent hackers from taking control of your server without needing to log in.
Information based on NVD, CISA KEV, and reputable security reporting.