보안 뉴스 · 취약점
2026-016: Critical Vulnerability in GitLab CE and EE
출처: CERT-EU · © Cybersecurity Service for the Union institutions, bodies, offices and agencies (CERT-EU). · CC BY 4.0
문서 서식과 링크를 FineTS 화면에 맞게 정리했습니다. 이미지·첨부파일은 공식 원문에서 확인하세요.
| 취약점 | 설명 | 조치사항 |
|---|---|---|
| CVE-2026-97229정수 오버플로 |
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation. |
|
| CVE-2026-92883 |
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to execute arbitrary JavaScript in the context of other users' browser sessions via a specially crafted repository, due to improper sanitization of HTML attributes in syntax-highlighted output. |
|
| CVE-2026-16301 |
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with Developer role to execute CI/CD pipelines on protected branches without authorization due to improper authorization checks in the downstream pipeline creation service. |
|
한국어 버튼을 눌러 번역을 요청할 수 있습니다.
On 12 October 2026, GitLab released versions 19.4.2, 19.3.4 and 19.2.8 of GitLab Community Edition (CE) and Enterprise Edition (EE), fixing 24 security issues among which a critical vulnerability that could allow an unauthenticated attacker to execute arbitrary code on the server. CERT-EU strongly r
History:
- 12/10/2026 --- v1.0 -- Initial publication
Summary
On 12 October 2026, GitLab released versions 19.4.2, 19.3.4 and 19.2.8 of GitLab Community Edition (CE) and Enterprise Edition (EE), fixing 24 security issues among which a critical vulnerability that could allow an unauthenticated attacker to execute arbitrary code on the server [1].
CERT-EU strongly recommends upgrading self-managed GitLab CE/EE instances to a fixed version as soon as possible, starting with internet-facing instances.
Technical Details
The vulnerability CVE-2026-97229, with a CVSS score of 10.0, is located in the CI/CD regular expression compiler [1]. Weak validation of regular expressions leads to an integer overflow, and a specially crafted expression in a CI/CD configuration can then trigger code execution [1].
The same release also fixes other vulnerabilities [1]:
- CVE-2026-92883 (CVSS: 8.7): a cross-site scripting flaw in syntax highlighting that lets an authenticated user run arbitrary JavaScript in other users' browsers through a crafted repository [1].
- CVE-2026-16301 (CVSS: 8.5): an authorisation flaw that lets a developer run pipelines on protected branches without permission [1].
- 21 further issues, including a cache poisoning bug rated 8.2 that could expose protected CI/CD variables [1].
Affected Products
The vulnerabilities affect the following versions of self-managed GitLab CE/EE instances [1]:
- before 19.4.2
- before 19.3.4
- before 19.2.8
Recommendations
CERT-EU strongly recommends upgrading all self-managed GitLab CE/EE instances to a fixed version, starting with internet-facing instances [1].
References
[1] https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/