GitLab is on KEV. A version bump is not the Ruby.

CISA added CVE-2026-97229 on 29 October. Due 1 November. Forensic triage Yes. Catalog 2026.10.29 / 1764. Omnibus patches Onigmo. Source installs do not.

RWP Ventures · 2026-10-30 · event 2026-10-29 · 14 min read · priority 9.3

Do not collapse five facts.

1. The overnight increment is KEV, not first disclosure. GitLab shipped 19.4.2 / 19.3.5 / 19.2.8 on 12 October. Rapid7 reproduced command execution as the git OS account on the official 19.4.1 CE image and published analysis on 13–16 October. Alpine Linux disclosed on 28 October that a newly registered account tried the bug against gitlab.alpinelinux.org on 20–21 October. [Yesterday’s Daily Top](/posts/2026-10-29-fragnesia-cve-2026-46300-kev/) recorded catalog 2026.10.28 / 1762 with this CVE off KEV. Thursday night’s listing is the federal clock and the forensic-triage flag.
2. A GitLab version bump is not the Ruby. The fix GitLab applied on 12 October is a patch to the Onigmo engine inside the Ruby that official Omnibus packages and official container images ship. Alpine upgraded to 19.3.6 on 22 October and stayed vulnerable because its image used standard Ruby. Upstream Ruby closed the same compiler bug on 23 October in 4.0.9 / 3.4.12 / 3.3.13. Source installs, custom images, and any GitLab that did not inherit GitLab’s bundled Ruby still need that Ruby train. gitlab-rake gitlab:env:info reporting 19.3.6 does not prove ruby -v.
3. Forensic triage is Yes. Unlike the sibling 29 October row CVE-2026-76418 (Cisco ASA/FTD SSL VPN DoS, forensic triage No), this row carries the BOD 26-04 pre-patch compromise flag. Alpine treated the instance as compromised and rebuilt it even after finding no proof the attacker’s code ran, because a successful hit can leave no crash and no web-log trace. A patched package string is not the close.
4. The sibling 29 October row is a firewall reload, not this RCE. CVE-2026-76418 (Cisco Secure Firewall ASA / FTD, CWE-690, CVSS 8.6) was added in the same alert, due 1 November, forensic triage No. Cisco PSIRT became aware of active exploitation in October 2026. It reloads the box when Remote Access SSL VPN is reachable and secondary authentication is set on the tunnel group. Do not close a GitLab hunt on an ASA build, or an ASA hunt on a GitLab tag.
5. CVE-2026-110264 is not this ticket and is not on KEV. GitLab’s 21 October releases (19.5.1 / 19.4.3 / 19.3.6 / 19.2.9 and older-branch backports) close a separate Onigmo overflow. Instances that stopped at 19.4.2 / 19.3.5 / 19.2.8 for 97229 are inside that later range. Do not treat the 12 October tag as the current floor.

The operator sentence: if a self-managed GitLab was reachable after 12 October — especially one built from source or a custom image — treat Sunday as the federal clock. Confirm the running Ruby, hunt the worker, then rotate secrets. A GitLab version string does not close CVE-2026-97229.

What happened

CISA’s 29 October KEV alert is two rows.

Those are the only two additions in catalog 2026.10.29. Prior newest rows remain [Linux kernel CVE-2026-46300 (Fragnesia)](/posts/2026-10-29-fragnesia-cve-2026-46300-kev/), due tomorrow, forensic triage Yes, and Broadcom VMware ESX CVE-2026-41709, due 11 November, forensic triage No.

CISA’s notes on 97229 are the second operator fact: other products can potentially be affected by the same underlying Ruby/Onigmo integer overflow, and CISA points at Ruby’s 23 October advisory plus GitLab’s 12 October patch post.

Independent records fill the gap between “12 October patch” and “listed”:

• 12 October. GitLab critical patch release. Impacted: CE/EE 19.2 before 19.2.8, 19.3 before 19.3.5, 19.4 before 19.4.2. GitLab.com already patched. Dedicated tenants patched on an internal release. No workaround. Reporter: joaxcar via HackerOne. GitLab originally named 19.3.4 as the 19.3 floor; the current advisory lists 19.3.4 as affected and 19.3.5 as the first fixed 19.3 build.
• 13–16 October. Rapid7 reproduced arbitrary commands as uid git on gitlab/gitlab-ce:19.4.1-ce.0 with ASLR on. Rapid7’s demonstrated path needs write access to plant a malicious .gitlab-ci.yml and a UTF-8 path on a public project; the trigger Rapid7 used is then an unauthenticated GET to the CI lint API. Rapid7 stated that prerequisite conflicts with GitLab’s PR:N rating, and that the original report is still private, so Rapid7 does not claim to know how the reported attack avoids the write step. That is one lab route, not a census.
• 20–21 October (Alpine, disclosed 28 October). Newly registered account sent crafted CI configurations to gitlab.alpinelinux.org, still on 19.3.4. Workers crashed 8 times. In 4 of those crashes the attacker got partway through the exploit and failed at the next step. The attacker also downloaded Alpine’s GitLab container image. Alpine found no evidence the attacker’s code ran, cannot rule it out, rebuilt from scratch, reset passwords, and replaced GitLab secret keys. aports, packages, and the 21 October releases were verified against records outside GitLab. Signing keys were never on that server.
• 22 October. Alpine upgraded to 19.3.6. That did not close the hole.
• 23 October. Ruby 4.0.9 / 3.4.12 / 3.3.13. Ruby did not assign its own CVEs; it tells operators to track GitLab’s identifiers. Regexp.timeout does not protect against these compiler bugs.
• 26 October. Alpine found the instance still vulnerable after the GitLab upgrade.
• 28 October. Alpine rebuild complete. Public post.
• 29 October, 19:09 UTC. CISA catalog 2026.10.29 / 1764. Both CVEs on KEV. MS-ISAC 2026-123 the same day.

CISA has not published a victim census, actor name, or ransomware overlay with the add. Alpine has not attributed the account. Do not invent either.

Why it matters

Three operational reasons this is the daily.

First: the asset is the software factory. Self-managed GitLab holds source, CI variables, runner tokens, deploy keys, package registries, and the identity of every engineer who pushes. Unauthenticated (or post-registration) code execution as the git account is total control of that host’s GitLab secrets even when it is not root. BOD 26-04 forensic triage is the right flag for that class.

Second: the patch you think you applied may not be the patch that runs. Official Omnibus and official GitLab images bundle a patched Ruby. Source compiles, Helm charts that install Ruby separately, and third-party images — Alpine’s alpinelinux/gitlab before the 27 October republish of 19.3.6 is the worked example — do not. CISA’s KEV note already widens the hunt past GitLab: any service that compiles attacker-controlled regular expressions through Onigmo is in scope for the same compiler bug, on Ruby 4.0.9 / 3.4.12 / 3.3.13. Ruby 3.2 reached end of life in April 2026 and will not get the fix.

Third: the public PoC and the Alpine probe both pre-date KEV. Rapid7’s analysis was public for more than two weeks before CISA listed the row. Alpine’s attacker was already iterating on 20 October. Sunday’s due date is an FCEB clock, not the start of exploitation.

Who / what is affected

Confirmed in scope for CVE-2026-97229 (GitLab CNA / NVD):

• GitLab CE and EE, all deployment types unless GitLab says otherwise: 19.2.0 through 19.2.7, 19.3.0 through 19.3.4, 19.4.0 through 19.4.1.
• Fixed GitLab tags for this CVE: 19.2.8, 19.3.5, 19.4.2. Current recommended tags on those trains also pick up CVE-2026-110264: 19.2.9, 19.3.6, 19.4.3, 19.5.1.

Confirmed not the customer’s problem: GitLab.com and GitLab Dedicated, per GitLab.

Confirmed still open after a GitLab-only bump: any self-compiled or custom-image install whose running Ruby is older than 3.3.13 / 3.4.12 / 4.0.9. Alpine’s 19.3.6 on standard Ruby is the primary evidence. Alpine users of alpinelinux/gitlab:19.3.6 pulled before 27 October, and all older tags, remain vulnerable until they pull again.

REPORTED, not a current census: Censys, on 13 October, counted 25,766 hosts and 79,224 web properties on affected GitLab versions. That number is two weeks old. Do not treat it as today’s internet.

Not this CVE: GitLab.com tenants. PHP2Shell. Fragnesia. Cisco ASA/FTD. Drupal Commerce Core (vendor-reported exploitation 28 October, not on KEV). CVE-2026-110264.

OT / ICS: UNKNOWN for process impact. A plant-engineering GitLab that holds PLC project files is still an IT compromise of an industrial organization’s software supply chain. That is not evidence a controller, safety system, or physical process was hit. Do not write it that way.

Technical context

High level, without a reproduction procedure.

GitLab evaluates regular expressions from CI configuration — including rules:exists:regexp / rules:changes:regexp — by compiling them with Ruby’s native Onigmo engine and matching them against repository paths. GitLab wraps that compile with length, repeat-bound, and compiled-size checks. Rapid7’s analysis describes how a pattern that passes those checks in US-ASCII can be recompiled for UTF-8 when it is evaluated against a path containing valid four-byte UTF-8 characters. That second compile sits outside GitLab’s 50 ms timeout and outside the size check. An integer overflow in Onigmo’s program-size calculation then produces invalid bytecode; Rapid7 turned that into command execution as the git user on 19.4.1 amd64.

GitLab’s CVSS is PR:N. Rapid7’s published end-to-end route still needs someone who can commit to a public project first; the unauthenticated step is the lint request. Open registration, as Alpine had, collapses that gap. Rapid7 does not claim that is the only path. We do not either.

Detection GitLab has already shipped: six threat detections for self-managed instances, linked from the 12 October patch post, including Sigma rules for oversized non-ASCII paths and Onigmo native worker crashes. GitLab’s own guidance with those rules is the one that matters for forensic triage: a successful exploit can leave no crash. Hunt files owned by git in /tmp, unexpected children of Puma or Sidekiq, outbound connections, and changed crontabs or SSH keys for git. A 502 on CI lint is a candidate, not proof.

ATT&CK mapping (assessed, not CISA-assigned): T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter (command as git).

Threat / exploitation status

What defenders should do

1. Inventory self-managed GitLab, then inventory the Ruby it actually runs. Omnibus / official image: move to the newest patch on the branch (19.5.1 / 19.4.3 / 19.3.6 / 19.2.9 or the documented backport). Source or custom image: that GitLab tag and Ruby 3.3.13 / 3.4.12 / 4.0.9. Do not stop at 19.3.4. Do not stop at a 12 October tag if you also need 110264 closed. GitLab.com / Dedicated: document and move on.
2. Hunt before you call the upgrade a close, because forensic triage is Yes. CI lint GETs with odd content_ref values. Worker crashes mentioning Onigmo / regexp_matcher. Long paths with non-ASCII. New accounts that created public projects in October. Unexpected git-owned files, SSH keys, crontabs, runner registrations, outbound connections. Alpine’s lesson: missing logs are not a clean bill of health.
3. If there is any sign of code execution, treat the instance as compromised. Rotate gitlab-secrets.json, all CI/CD variables, all runner tokens, all access tokens, webhook and integration credentials, and password hashes. Rebuild beats “patch and hope” when the evidence a successful hit would leave is the evidence you no longer have.
4. Reduce the write surface until the Ruby is fixed. Restrict account registration. Stop untrusted users creating or writing public projects. Rapid7 notes those steps cover its route only and do not fix the compiler.
5. Widen past GitLab. CISA said so. Any in-house app that compiles untrusted input with Regexp.new / Regexp.compile / /#{input}/ on unpatched Ruby is the same Onigmo bug under a different ticket name. Ruby 3.2 will not be patched; move it.
6. Sequence the rest of this week’s clock. [Fragnesia CVE-2026-46300](/posts/2026-10-29-fragnesia-cve-2026-46300-kev/) is due tomorrow, forensic triage Yes — a PHP bump is still not that kernel. Cisco CVE-2026-76418 shares Sunday’s due date: reachable SSL VPN plus secondary-authentication-server-group on the tunnel group (including DefaultWEBVPNGroup when the group list is off). Cisco lists no workaround; disabling secondary authentication is a mitigation that lowers VPN assurance. Patch ASA/FTD instead. [PHP2Shell](/posts/2026-10-27-php2shell-kev-due-thursday/) was due yesterday.

RWP assessment

This is the daily because it is a new KEV row on a CVSS 10 self-managed DevOps control plane, with forensic triage Yes, a three-day federal clock, and a worked counter-example that the GitLab tag is not the running interpreter. Evidence quality is high: CISA catalog, GitLab advisory, Ruby advisory, Alpine primary disclosure, Rapid7 reproduction. We are not treating Alpine as a confirmed RCE, not naming an actor, not folding Cisco’s VPN DoS into this campaign, and not promoting CVE-2026-110264 to KEV.

Score 9.3. It outranks the Cisco sibling (same catalog, DoS not RCE, forensic triage No), yesterday’s Fragnesia row (already published; due tomorrow, still live as a clock), Drupal Commerce Core’s 28 October “highly critical / exploited” module advisory (not KEV, access bypass), and the 30 October reporting of a compromised Claude Code VS Code extension (supply-chain, still developing, not a KEV increment).

What we are watching

• Whether CISA revises the 97229 notes with a product list beyond GitLab and Ruby.
• Whether CVE-2026-110264, or any of the other Onigmo GitLab CVEs (CVE-2026-89078, CVE-2026-93577), lands on KEV.
• Whether GitLab or a national CERT publishes a victim set larger than Alpine’s probe.
• Cisco CVE-2026-76418: victim impact, whether the DoS is being used as cover for something else. Cisco has not said so.
• Catalog increment past 2026.10.29 / 1764.

Sources

• CISA — Adds Two Known Exploited Vulnerabilities to Catalog, 29 October 2026
• CISA — KEV JSON feed
• CISA — Known Exploited Vulnerabilities Catalog
• CISA — BOD 26-04 implementation guidance
• GitLab — Critical Patch Release 19.4.2, 19.3.5, 19.2.8
• GitLab — Critical Patch Release 19.5.1
• NVD — CVE-2026-97229
• Ruby — Regexp compilation fixes related to GitLab CVEs, 23 October 2026
• Alpine Linux — GitLab security incident: attempted exploitation of CVE-2026-97229, 28 October 2026
• Rapid7 — CVE-2026-97229 critical unauthenticated RCE
• Rapid7 — Technical analysis
• The Hacker News — CISA adds GitLab RCE and Cisco firewall DoS to KEV, 30 October 2026
• The Hacker News — Alpine Linux GitLab, 29 October 2026
• SecurityWeek — Max-severity GitLab vulnerability exploited against Alpine Linux, 30 October 2026
• MS-ISAC — 2026-123
• Cisco — cisco-sa-asaftd-tunnel-dos-s6mgkb75
• Canadian Centre for Cyber Security — AV26-1102 Update 1
• [RWP — Fragnesia KEV, 29 October 2026](/posts/2026-10-29-fragnesia-cve-2026-46300-kev/)
• [RWP — PHP2Shell KEV, 27 October 2026](/posts/2026-10-27-php2shell-kev-due-thursday/)
• [RWP — GitLab CVE-2026-85706, 12 September 2026](/posts/2026-09-12-gitlab-cve-2026-85706-path-traversal/)