# GitLab patches critical CI/CD RCE flaw

Published: 2026-10-13 · Severity: routine · Sectors: technology
Canonical: https://vorant.io/reports/92983d5d-e126-5161-b135-5cc9acbd848a/gitlab-patches-critical-ci-cd-rce-flaw

> GitLab fixed 24 vulnerabilities including a CVSS 10.0 unauthenticated RCE via malicious CI/CD config; no in-the-wild exploitation reported.

NCSC-NL issued an advisory summarizing GitLab's remediation of 24 vulnerabilities across GitLab Community Edition (CE) and Enterprise Edition (EE), affecting versions prior to 19.2.8, 19.3.5, and 19.4.2. The flaws span multiple components including the CI/CD pipeline environment, authorization mechanisms, the API, Kubernetes integration, and the package registry. Weakness classes include XSS, SSRF, open redirect, race conditions, incorrect authorization, sensitive data logging, integer overflow, and improper neutralization of LLM prompt input.

The most severe issue, CVE-2026-97229, carries a maximum CVSS 3.1 score of 10.0 and allows an unauthenticated attacker to execute arbitrary code via a malicious CI/CD configuration. Several other high-severity flaws (CVE-2026-92883, CVE-2026-16301, CVE-2026-14814) could enable unauthorized access to sensitive data or privilege abuse. No exploitation in the wild is mentioned in this advisory.

GitLab has released fixed versions 19.2.8, 19.3.5, and 19.4.2 addressing all listed CVEs. NCSC-NL recommends that organizations running affected GitLab CE/EE instances apply these updates promptly given the breadth and severity of the issues, particularly the unauthenticated RCE vector.

## Mentioned in this report

- Vulnerabilities: CVE-2026-100104, CVE-2026-100755, CVE-2026-101168, CVE-2026-103549, CVE-2026-104661, CVE-2026-105458, CVE-2026-14210, CVE-2026-14552, CVE-2026-14814, CVE-2026-16275, CVE-2026-16301, CVE-2026-5954, CVE-2026-6567, CVE-2026-7767, CVE-2026-78335, CVE-2026-81839, CVE-2026-82632, CVE-2026-84284, CVE-2026-85529, CVE-2026-92528, CVE-2026-9268, CVE-2026-92883, CVE-2026-96893, CVE-2026-97229

Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0414.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/92983d5d-e126-5161-b135-5cc9acbd848a/gitlab-patches-critical-ci-cd-rce-flaw.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup