Internetga ochiq 1 000 dan ortiq GitLab serverlari hali ham maksimal darajadagi zaiflikka qarshi yamoqlanmagan bo'lib, bu zaiflik masofaviy kod bajarish (RCE) hujumlarida faol ravishda ekspluatatsiya qilinmoqda.
CVE-2026-97229 sifatida kuzatiladigan bu zaiflik butun son to'lib ketishi (integer overflow) zaifligidan kelib chiqadi va CI/CD muntazam ifoda kompilyatorida (Regular Expression Compiler) aniqlangan bo'lib, u quvur konfiguratsiya fayllaridagi muntazam ifodalarni tahlil qiladi va baholaydi.
"GitLab ma'lum sharoitlarda autentifikatsiya qilinmagan foydalanuvchiga CI/CD konfiguratsiyasidagi maxsus tayyorlangan muntazam ifoda orqali GitLab serverida ixtiyoriy kodni bajarish imkonini berishi mumkin bo'lgan muammoni tuzatdi, bu esa muntazam ifodalarni yetarlicha tekshirmaslik natijasida yuzaga kelgan," deb tushuntirdi kompaniya 12-oktabrda, xavfsizlik muammosini GitLab Community Edition (CE) va Enterprise Edition (EE) 19.4.2, 19.3.5 va 19.2.8 versiyalarida tuzatish uchun xavfsizlik yamoqlarini chiqarishda.
"Bu versiyalar muhim xato va xavfsizlik tuzatishlarini o'z ichiga oladi va biz barcha o'z-o'zini boshqaradigan GitLab o'rnatishlarini zudlik bilan ushbu versiyalardan biriga yangilashni qat'iy tavsiya qilamiz. GitLab.com allaqachon yamoqlangan versiyada ishlamoqda. GitLab Dedicated mijozlari hech qanday chora ko'rishlari shart emas," deb qo'shimcha qildi u.
Juma kuni AQSh Kiberxavfsizlik va infratuzilma xavfsizligi agentligi (CISA) hujumchilar zaiflikni amalda ekspluatatsiya qila boshlaganini tasdiqladi va CVE-2026-97229 ni Ma'lum Ekspluatatsiya Qilinadigan Zaifliklar (KEV) Katalogiga qo'shib, federal agentliklarga serverlarini yakshanbagacha himoyalashni buyurdi.
GitLab yamoqlarni uch hafta oldin chiqargan bo'lsa-da, tahdid kuzatuvchisi Shadowserver hafta oxirida 1 000 dan ortiq yamoqlanmagan GitLab serverlari davom etayotgan hujumlarga ochiq ekanligini kuzatayotganini ma'lum qildi.
Zaif GitLab nusxalari onlayn ochiq (Shadowserver)
CVE-2026-97229 bu yil boshidan beri GitLab tomonidan tuzatilgan xavfsizlik muammolari qatoridagi eng so'nggisidir. Yanvarda GitLab yuqori darajadagi zaiflikni (CVE-2026-0723) tuzatdi, bu hujumchilarga ikki omilli autentifikatsiyani chetlab o'tish imkonini beradi, sentyabrda esa ombor commitlari API'dagi maksimal darajadagi zaiflik (CVE-2026-85706) tuzatildi, bu esa ma'lumotlar va boshqa sirlarni o'g'irlash uchun ekspluatatsiya qilinishi mumkin.
CISA shuningdek, CVE-2026-85706 ni faol ravishda suiiste'mol qilinayotgani haqida xabar berdi, chunki kiberxavfsizlik firmasi watchTowr hujumchilar allaqachon zaif GitLab serverlarini skanerlashni boshlaganini ma'lum qilgan edi.
O'tgan oyda u yana bir maksimal darajadagi Muntazam Ifoda Kompilyatori xatosini (CVE-2026-110264) tuzatdi, bu tahdid ishtirokchilariga maqsadli nusxalarda ixtiyoriy kodni bajarish imkonini beradi.
"Biz hozirda CVE-2026-97229 ga (CISACyber KEV ro'yxatida) nisbatan zaif 1 000 dan ortiq GitLab nusxasini va CVE-2026-110264 ga nisbatan zaif 11 300 dan ortiq nusxani kuzatayapmiz (biz har kuni ko'radigan taxminan 39 000 GitLab nusxasidan)," deb aytdi Shadowserver yakshanba kuni.
2021-yil noyabridan beri CISA faol ekspluatatsiya qilinadigan zaifliklar katalogiga oltita GitLab zaifligini qo'shgan, ulardan biri ransomware hujumlarida ham ishlatilgan.
GitLab o'zining DevSecOps platformasi 70 milliondan ortiq ro'yxatdan o'tgan foydalanuvchiga ega ekanligini va dunyo bo'ylab Fortune 100 kompaniyalarining 50% dan ortig'i tomonidan ishlatilishini aytadi.
Mavjud himoyalaringiz o'tkazib yuborishi mumkin bo'lgan elektron pochta tahdidlarini aniqlang.
Adaptive Security'ning AI agentlari elektron pochta niyati, konteksti va xulq-atvorini tahlil qilib, fishing, biznes elektron pochta buzilishi va hisob-faktura firibgarligini aniqlaydi.
Microsoft 365 yoki Google Workspace'ning 14 kunlik faqat o'qish skaneri bilan nima o'tib ketayotganini ko'ring, MX o'zgarishlarsiz.
Bepul elektron pochta xavfsizligi skaneringizni boshlang.
Over 1,000 Internet-exposed GitLab servers are still unpatched against a maximum-severity flaw actively exploited in remote code execution attacks.
Tracked as CVE-2026-97229, this vulnerability stems from an integer overflow weakness and was discovered in the CI/CD Regular Expression Compiler, which parses and evaluates regular expressions in pipeline configuration files.
"GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation," the company explained on October 12 when it released security patches to address the security issue in GitLab Community Edition (CE) and Enterprise Edition (EE) versions 19.4.2, 19.3.5, and 19.2.8.
"These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action," it added.
On Friday, the US Cybersecurity and Infrastructure Security Agency (CISA) confirmed that attackers have begun exploiting the flaw in the wild and added CVE-2026-97229 to its Known Exploited Vulnerabilities (KEV) Catalog, ordering federal agencies to secure their servers by Sunday.
Although GitLab released patches three weeks ago, threat watchdog Shadowserver revealed over the weekend that it tracks more than 1,000 unpatched GitLab servers exposed to ongoing attacks.
Vulnerable GitLab instances exposed online (Shadowserver)
CVE-2026-97229 is the latest in a series of GitLab security issues addressed since the start of the year. In January, GitLab fixed a high-severity flaw (CVE-2026-0723) that lets attackers bypass two-factor authentication, and in September,a maximum-severity vulnerability(CVE-2026-85706) in the repository commits API that can be exploited to steal credentials and other secrets.
CISA also flagged CVE-2026-85706 as actively abused in the wild after cybersecurity firm watchTowr reported that attackers had already begun scanning for vulnerable GitLab servers.
Last month, it addressed another maximum-severity Regular Expression Compiler bug (CVE-2026-110264) that lets threat actors run arbitrary code on targeted instances.
"We are currently tracking over 1000 GitLab instances vulnerable to CVE-2026-97229 (on @CISACyber KEV) and over 11300 instances vulnerable to CVE-2026-110264 (out of around 39K GitLab instances we see daily)," Shadowserver said on Sunday.
Since November 2021, CISA has added six GitLab flawsto its catalog of actively exploited vulnerabilities, one of which has also been used in ransomware attacks.
GitLab says its DevSecOps platform has over 70 million registered users and is used by more than 50% of Fortune 100 companies worldwide.
Uncover email threats your existing defenses may miss.
Adaptive Security's AI agents analyze email intent, context, and behavior to uncover phishing, business email compromise, and invoice fraud.
See what's getting through with a 14-day read-only scan of Microsoft 365 or Google Workspace, with no MX changes.
Start your free email security scan.