Act
active
Attacker Exploits GitLab CVSS 10.0 RCE via CI Config Regex
- Engineer — Act: CVSS 10.0 RCE via crafted CI regex with a public PoC and a confirmed exploitation attempt against a live GitLab server; patch your GitLab instance to the latest fixed release immediately and audit CI configuration pipelines for unexpected regex patterns.
- SOC/IR — Act: An exploitation attempt against Alpine Linux’s GitLab server confirms active targeting; sweep GitLab server access and CI pipeline execution logs for anomalous regex patterns in CI configs since roughly October 21 and tune detections for RCE attempts via GitLab’s CI parsing endpoint.
- Leader — Plan: A CVSS 10.0 GitLab RCE with a public PoC and active exploitation attempts poses supply-chain risk if your engineering teams self-host GitLab; confirm with engineering that all instances are patched this week and assess whether any CI/CD outputs or secrets could have been exposed.
- Signals: CVE-2026-97229 — CISA KEV: not listed, EPSS 0.18, public PoC on GitHub, reported by 2 collected sources
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.