GitLab has released urgent security patches to address two critical vulnerabilities—CVE-2026-89078 and CVE-2026-93577—that could permit authenticated users to execute arbitrary code on self-hosted GitLab CE and EE servers by submitting malicious regular expressions in CI/CD pipelines. The company pushed updates (releases 19.4.1, 19.3.3, and 19.2.7) on September 23, 2026, urging all administrators to upgrade immediately. Hosted GitLab.com instances are already protected, and Dedicated customers are unaffected by these flaws.
The Vulnerabilities Explained
The first issue, CVE-2026-89078, stems from a double-free bug in GitLab’s regular expression parser. This defect allows the same memory block to be released twice in certain regex-handling conditions, which can lead to memory corruption. Attackers capable of injecting crafted regex inputs via CI/CD configuration files could exploit this to crash services or, worse, gain execution control over the server.
The second flaw, CVE-2026-93577, is an integer overflow in GitLab’s regex compiler. In this case, numeric operations exceed permissible bounds when processing malicious regexes, again through CI/CD definitions. Under certain circumstances, this overflow may open a path for executing code remotely with elevated capability on vulnerable hosts.
Scope, Risk, and Urgency
Both vulnerabilities carry the maximum CVSS severity rating of 9.9. Their reach extends across GitLab CE and EE versions from 19.2 up to—but not including—the fixed versions. That means versions before 19.2.7, 19.3.3, or 19.4.1 are at risk. Although exploitation requires the attacker to have at least minor credentials, many GitLab instances grant access broadly—developers, external collaborators, CI runners—making even low-privileged accounts a possible threat vector.
Because GitLab servers typically hold sensitive assets such as source code, build secrets, project variables, access tokens, and deployment credentials, a successful exploit could cascade into serious supply-chain compromise. Unauthorized access may lead attackers to view private repositories, alter build logic, exfiltrate credentials, or tamper with connected infrastructure.
What Has Been Fixed—and Next Steps
In addition to patching the regex flaws, GitLab addressed related high-severity issues including a cross-site scripting flaw in the merge-request diff viewer, and a vulnerability in the Duo AI job-troubleshooting feature that disclosed CI/CD variable values to unauthorized users. These found-and-fixed bugs reinforce the need for vigilance across the CI/CD feature set, not just core code exec paths.
Administrators of self-managed GitLab CE and EE environments must upgrade to releases 19.4.1, 19.3.3, or 19.2.7 immediately. Single-node deployments should plan for downtime during database migrations, while multi-node setups may use zero-downtime strategies where applicable. It’s also wise to audit recent changes in CI/CD configurations, especially any added or modified regular expressions in .gitlab-ci.yml files.
Teams should monitor audit logs for irregular activity: unexpected pipeline behavior, anomalous runner operations, strange access to CI/CD variables, or unusual project modifications. These signs can reveal whether someone may have already tried to exploit the vulnerability.
This is not just another software update—it’s a critical incident requiring prompt action across every layer of development infrastructure.
By recommending, auditing, and monitoring, you protect not just your GitLab server—you guard your entire software supply chain’s integrity. Be alert.
