Critical GitLab Flaw Allows Unauthenticated Code Execution

En bref

• CVE-2026-97229 affects GitLab Community and Enterprise editions and enables unauthenticated remote code execution.
• Successful exploitation can lead to full server compromise.
• Apply vendor mitigations or patch in accordance with BOD 26-04.
• Inventory internet-facing GitLab instances and remove or isolate any that cannot be mitigated.

GitLab deployments in both Community and Enterprise editions are exposed to a critical flaw, CVE-2026-97229, that an unauthenticated party can use to execute arbitrary code. Because no login is required, the attack surface includes any reachable web endpoint rather than only authenticated administrative functions. The stated impact is execution of attacker-controlled code and compromise of the underlying server.

The affected population is broad: agencies, schools, and vendors that host GitLab for source control, CI/CD, or internal collaboration. Internet-facing instances deserve immediate attention. Even instances believed to be internal can be reachable through misconfigured proxies, VPN gaps, or forgotten cloud deployments.

Why this matters: GitLab often holds source code, pipeline secrets, deployment credentials, and integration tokens. Server compromise can therefore cascade into supply-chain risk, data exposure, and further intrusion into connected environments. A critical rating is appropriate when unauthenticated code execution can lead to full host takeover.

Guidance calls for applying mitigations and patching in line with BOD 26-04. Teams should assess public exposure, prioritize remediation for internet-reachable systems, and, where mitigations are not available, discontinue use rather than operate an exposed instance. Patching should be verified, not assumed.

What to watch: exploitation attempts may appear in web logs as anomalous requests, followed by unexpected processes, new accounts, altered repositories, or outbound connections. Monitor advisories for CVE-2026-97229, track version compliance, and preserve logs for investigation.

À faire maintenant

1. Identify every GitLab Community and Enterprise deployment, including cloud, on-premises, and forgotten test instances; record version, owner, and public reachability.
2. Immediately restrict public access to GitLab management interfaces via firewall, VPN, or zero-trust proxy until patched.
3. Apply the vendor mitigations and the patch required by BOD 26-04; validate the installed version after upgrade.
4. If mitigations or patching cannot be completed, decommission or disconnect the instance per guidance rather than leave it exposed.
5. Hunt for signs of exploitation: unexpected processes, new admin accounts, modified repositories, outbound connections, and web shell artifacts.
6. Rotate secrets, tokens, SSH keys, and CI/CD credentials if compromise is suspected; review audit logs for anomalous activity.
7. Add GitLab to vulnerability management and emergency change processes, and monitor CVE-2026-97229 advisories for updates.

Source originale

CISA Known Exploited Vulnerabilities