AQSh Kiberxavfsizlik va infratuzilma xavfsizligi agentligi (CISA) ma'lumotiga ko'ra, hujumchilar shu oy boshida tuzatilgan maksimal darajadagi GitLab zaifligini faol foydalanishni boshlagan.
CVE-2026-97229 sifatida kuzatiladigan bu muhim xavfsizlik zaifligi "joaxcar" taxallusidan foydalanuvchi xavfsizlik tadqiqotchisi tomonidan CI/CD muntazam ifoda kompilyatorida aniqlangan. U quvur konfiguratsiya fayllarida muntazam ifodalarni tahlil qiladi, kompilyatsiya qiladi va baholaydi.
CVE-2026-97229 butun son to'lib ketishi zaifligidan kelib chiqadi va masofaviy hujumchilarga CI/CD konfiguratsiyasidagi maxsus tayyorlangan muntazam ifoda orqali maqsadli nusxalarda ixtiyoriy kodni bajarishga imkon berishi mumkin, chunki ifoda yetarlicha tekshirilmaydi.
"GitLab ma'lum sharoitlarda autentifikatsiya qilinmagan foydalanuvchiga CI/CD konfiguratsiyasidagi maxsus tayyorlangan muntazam ifoda orqali GitLab serverida ixtiyoriy kodni bajarishga imkon berishi mumkin bo'lgan muammoni tuzatdi, chunki muntazam ifoda yetarlicha tekshirilmagan", — deyiladi bayonotda.
GitLab bu xavfsizlik muammosini GitLab Community Edition (CE) va Enterprise Edition (EE) 19.4.2, 19.3.5 va 19.2.8 versiyalarida tuzatdi va administratorlarni serverlarini zudlik bilan yangilashga chaqirdi.
Kompaniya o'z-o'zini boshqaradigan nusxalarga ega mijozlarga yordam berish uchun tahdidni aniqlash vositalarini ham chiqardi, chunki foydalanish urinishlari aniqlangan.
Payshanba kuni AQSh Kiberxavfsizlik va infratuzilma xavfsizligi agentligi (CISA) faol foydalanishni tasdiqladi va CVE-2026-97229 ni Ma'lum foydalaniladigan zaifliklar (KEV) katalogiga qo'shdi. CISA shuningdek, federal agentliklarga serverlarini yakshanbagacha himoya qilishni buyurdi, bu Majburiy operatsion direktiva (BOD) 26-04 talabiga muvofiq.
BOD 26-04 faqat federal agentliklarga qaratilgan bo'lsa-da, kiberxavfsizlik agentligi barcha xavfsizlik jamoalarini, shu jumladan xususiy sektorni ham, davom etayotgan hujumlardan tarmoqlarini himoya qilish uchun bu zaiflikni tuzatishni ustuvor vazifa sifatida ko'rishga chaqirdi.
Internet tahdid kuzatuvchisi Shadowserver deyarli 2800 ta Internetga ochiq GitLab Community Edition nusxasini kuzatmoqda, lekin ularning qanchasi allaqachon hujumlardan himoyalanganini aytmaydi.
GitLab CE nusxalari onlayn ochiq (Shadowserver)
CVE-2026-97229 — GitLab yil boshidan beri tuzatgan xavfsizlik muammolarining so'nggisi. Yanvarda u yuqori darajadagi ikki omilli autentifikatsiyani chetlab o'tish zaifligini (CVE-2026-0723) tuzatdi, bu hujumchilarga maqsadning hisob ID sini bilgan holda ikki omilli autentifikatsiyani chetlab o'tishga imkon beradi.
Shu oy boshida u shuningdek maksimal darajadagi Muntazam ifoda kompilyatori zaifligini (CVE-2026-110264) tuzatdi, bu masofaviy hujumchilarga maqsadli nusxalarda ixtiyoriy kodni bajarishga imkon berishi mumkin edi.
Deyarli ikki hafta o'tgach, GitLab ombor commitlari API'dagi yana bir maksimal darajadagi zaiflikni (CVE-2026-85706) tuzatdi, bu zaif serverlardan hisob ma'lumotlari va boshqa sirlar kabi maxfiy ma'lumotlarni o'qish uchun suiiste'mol qilinishi mumkin.
Bir kun o'tgach, CISA CVE-2026-85706 ni faol foydalaniladigan zaifliklar ro'yxatiga qo'shdi, chunki kiberxavfsizlik firmasi watchTowr hujumchilar allaqachon tuzatilmagan GitLab serverlarini Internetda qidirishni boshlaganini xabar qildi.
CISA 2021-yil noyabridan beri oltita GitLab zaifligini yovvoyi tabiatda foydalaniladigan deb belgilagan, shu jumladan fevral oyida kuzatilgan ikkitasini (CVE-2021-22175 va CVE-2021-39935).
GitLab'ning DevSecOps platformasi Fortune 100 kompaniyalarining 50% dan ortig'i tomonidan ishlatiladi va dunyo bo'ylab 70 milliondan ortiq ro'yxatdan o'tgan foydalanuvchiga ega.
Hujumchilar haqiqiy hisob ma'lumotlariga ega bo'lgach, ularning harakatlarining faqat 37% i bloklanadi
Umumiy oldini olish ballari dastlabki kirishdan keyin nima sodir bo'lishini yashirishi mumkin. Hujumchilar haqiqiy hisob ma'lumotlaridan foydalanayotganda, oldini olish keskin pasayadi.
Blue Report 2026 mijozlar ishlab chiqarish muhitlarida o'tkazilgan 338 million simulyatsiya bo'yicha texnika-texnika himoyani o'lchaydi.
Hisobotni oling
Attackers have started exploiting a maximum-severity GitLab vulnerability patched earlier this month, according to the US Cybersecurity and Infrastructure Security Agency (CISA).
Tracked as CVE-2026-97229, this critical security flaw was discovered by a security researcher using the 'joaxcar' handle in the CI/CD Regular Expression Compiler, which parses, compiles, and evaluates regular expressions in pipeline configuration files.
CVE-2026-97229 stems from an integer overflow weakness and could let remote attackers run arbitrary code on targeted instances via a maliciously crafted regular expression in a CI/CD configuration, due to insufficient expression validation.
"GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation," it said.
GitLab addressed the security issue in GitLab Community Edition (CE) and Enterprise Edition (EE) versions 19.4.2, 19.3.5, and 19.2.8 and urged admins to patch their servers immediately.
The company has also released threat detections to support customers with self-managed instances after detecting exploitation attempts.
On Thursday, the US Cybersecurity and Infrastructure Security Agency (CISA) confirmed active exploitation and added CVE-2026-97229 to its Known Exploited Vulnerabilities (KEV) Catalog. CISA also ordered federal agencies to secure their servers by Sunday, as mandated by Binding Operational Directive (BOD) 26-04.
Although BOD 26-04 targets only federal agencies, the cybersecurity agency encouraged all security teams, including those in the private sector, to prioritize patching this flaw to protect their networks against ongoing attacks.
Internet threat watchdog Shadowserver tracks nearly 2,800 Internet-exposed GitLab Community Edition instances, but it doesn't say how many have already been secured against attacks.
GitLab CE instances exposed online (Shadowserver)
CVE-2026-97229 is the latest in a string of security issues GitLab has addressed since the start of the year. In January, it patched a high-severity two-factor authentication bypass (CVE-2026-0723) that lets attackers who know the target's account ID circumvent two-factor authentication.
Earlier this month, it also fixed a maximum-severity Regular Expression Compiler flaw (CVE-2026-110264) that could let remote attackers run arbitrary code on targeted instances.
Almost two weeks later, GitLab addressed another maximum-severity vulnerability (CVE-2026-85706) in the repository commits API that can be abused to read sensitive data, such as credentials and other secrets, from vulnerable servers.
One day later, CISA added CVE-2026-85706 to its list of actively exploited flawsafter cybersecurity firm watchTowr reported that attackers had already begun scanning the Internet for unpatched GitLab servers.
CISA has taggedsix GitLab vulnerabilities as exploited in the wildsince November 2021, including two (tracked as CVE-2021-22175 and CVE-2021-39935) in February this year.
GitLab's DevSecOps platform is used by over 50% of Fortune 100 companies and has more than 70 million registered users worldwide.
Once attackers have valid credentials, only 37% of their actions are blocked
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
Get the report