poslední zpráva
SPOJENO AI KEV ✓ (1 z 24) EPSS 0.27 (nejvyšší)
GitLab warns of max severity code execution vulnerability
GitLab warned users today to immediately patch a maximum-severity vulnerability in the CI/CD Regular Expression Compiler that could let remote attackers run arbitrary code on targeted instances. [...]
Alpine Linux GitLab US CZ SE NL FI EU IT FR
CVE v události 24
| CVE | hodnocení | KEV | EPSS |
|---|---|---|---|
| CVE-2026-100104 | 3.5 3.1 · GitLab | – | 0.00 |
| CVE-2026-100755 | 4.6 3.1 · GitLab | – | 0.00 |
| CVE-2026-101168 | 6.2 3.1 · GitLab | – | 0.00 |
| CVE-2026-103549 | 2.7 3.1 · GitLab | – | 0.00 |
| CVE-2026-104661 | 4.3 3.1 · GitLab | – | 0.00 |
| CVE-2026-105458 | 4.3 3.1 · GitLab | – | 0.00 |
| CVE-2026-14210 | 4.3 3.1 · GitLab | – | 0.00 |
| CVE-2026-14552 | 4.3 3.1 · GitLab | – | 0.00 |
| CVE-2026-14814 | 8.2 3.1 · GitLab | – | 0.00 |
| CVE-2026-16275 | 5.3 3.1 · GitLab | – | 0.00 |
| CVE-2026-16301 | 8.5 3.1 · GitLab | – | 0.00 |
| CVE-2026-5954 | 4.2 3.1 · GitLab | – | 0.00 |
| CVE-2026-6567 | 4.3 3.1 · GitLab | – | 0.00 |
| CVE-2026-7767 | 5.8 3.1 · GitLab | – | 0.00 |
| CVE-2026-78335 | 4.2 3.1 · GitLab | – | 0.00 |
| CVE-2026-81839 | 7.7 3.1 · GitLab | – | 0.00 |
| CVE-2026-82632 | 3.1 3.1 · GitLab | – | 0.00 |
| CVE-2026-84284 | 5.3 3.1 · GitLab | – | 0.00 |
| CVE-2026-85529 | 5.3 3.1 · GitLab | – | 0.00 |
| CVE-2026-92528 | 4.2 3.1 · GitLab | – | 0.00 |
| CVE-2026-9268 | 2.7 3.1 · GitLab | – | 0.00 |
| CVE-2026-92883 | 8.7 3.1 · GitLab | – | 0.00 |
| CVE-2026-96893 | 7.3 3.1 · GitLab | – | 0.01 |
| CVE-2026-97229 | 10.0 3.1 · GitLab | KEV ✓ | 0.27 |
Hodnocení z katalogů, všechna, se stupnicí CVSS a vydavatelem. Rozpad vektoru je na stránce CVE. Advisory v textu uvádí CVSS 10.0.
Tahle CVE jsem vytáhl z širšího textu článku: CVE-2026-0723, CVE-2026-85706. Neukazuju u nich proto fakta z katalogů výše, a to preventivně, protože článek se na ně mohl jen odkazovat, třeba jako na starší kauzu.
Jak se o tom psalo 12
-
· BleepingComputer US
Alpine Linux rebuilds GitLab after attempted RCE attack
Hackers attempted to exploit a critical GitLab vulnerability in Alpine Linux's development infrastructure on October 20-21, prompting the open-source project to rebuild its GitLab server and reset all passwords over concerns of a possible compromise. [...]
-
· zachyceno · CISA KEV US
GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability (CVE-2026-97229)
CISA added CVE-2026-97229 to the Known Exploited Vulnerabilities catalog. Affected product: GitLab Community Edition and Enterprise Edition. Remediation due date: 2026-11-01.
-
· CSIRT.CZ (CZ.NIC) CZ
Kritická zranitelnost v GitLabu umožňuje vzdálené spuštění kódu
Společnost GitLab vydala bezpečnostní aktualizace opravující 24 zranitelností v produktech GitLab Community Edition (CE) a Enterprise Edition (EE). Nejzávažnější z nich je CVE-2026-97229 (CVSS 10.0), která v důsledku nedostatečné validace regulárních výrazů v komponentě CI/CD umožňuje neautentizovanému útočníkovi vzdáleně spustit libovolný kód. Další opravené zranitelnosti umožňují například útoky typu XSS či neoprávněné spouštění CI/CD pipeline na chráněných větvích repozitáře. Provozovatelům…
-
· Rapid7 US
CVE-2026-97229: Critical Unauthenticated Remote Code Execution in GitLab
Overview On October 12, 2026, GitLab published a critical patch release for CVE-2026-97229, an integer overflow or wraparound (CWE-190) in the CI/CD regular expression compiler affecting GitLab Community Edition (CE) and Enterprise Edition (EE). GitLab assigned the vulnerability a CVSSv3.1 score of 10.0. Under certain conditions, a remote attacker can execute arbitrary code on an affected GitLab server through a specially crafted regular expression stored in a malicious CI/CD configuration.…
-
· CERT-SE SE
GitLab rättar kritisk sårbarhet
GitLab har publicerat säkerhetsuppdateringar för flera sårbarheter i GitLab Community Edition (CE) och Enterprise Edition (EE). [1]
-
· NCSC-NL NL
NCSC-2026-0414 [1.00] [M/H] Kwetsbaarheden verholpen in GitLab
GitLab heeft kwetsbaarheden verholpen in GitLab Community Edition (CE) en Enterprise Edition (EE), specifiek in versies voorafgaand aan 19.2.8, 19.3.5 en 19.4.2. De kwetsbaarheden zijn aanwezig in verschillende onderdelen van GitLab, waaronder de CI/CD pipelineomgeving, autorisatiemechanismen, API, Kubernetes-integratie en package registry. Kwaadwillenden kunnen de kwetsbaarheden misbruiken voor het uitvoeren van willekeurige code, vergrijken van ongeautoriseerde toegang tot gevoelige gegevens…
-
· zachyceno · NCSC-FI FI
GitLab Critical Patch Released
Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 10.0, CVEs: CVE-2026-97229, CVE-2026-92883, CVE-2026-16301, CVE-2026-14814, CVE-2026-81839, CVE-2026-96893, CVE-2026-101168, CVE-2026-7767, CVE-2026-16275, CVE-2026-84284, CVE-2026-85529, CVE-2026-100755, CVE-2026-14552, CVE-2026-6567, CVE-2026-104661, CVE-2026-14210, CVE-2026-105458, CVE-2026-5954, CVE-2026-92528, CVE-2026-78335 (+4 other associated CVEs), Summary: On October 12, 2026, we released…
-
· BleepingComputer US nadpis události
GitLab warns of max severity code execution vulnerability
GitLab warned users today to immediately patch a maximum-severity vulnerability in the CI/CD Regular Expression Compiler that could let remote attackers run arbitrary code on targeted instances. [...]
-
· CERT-EU EU
2026-016: Critical Vulnerability in GitLab CE and EE
On 12 October 2026, GitLab released versions 19.4.2, 19.3.4 and 19.2.8 of GitLab Community Edition (CE) and Enterprise Edition (EE), fixing 24 security issues among which a critical vulnerability that could allow an unauthenticated attacker to execute arbitrary code on the server. CERT-EU strongly recommends upgrading self-managed GitLab CE/EE instances to a fixed version as soon as possible, starting with internet-facing instances.
-
· CSIRT Itálie (ACN) IT
Risolte vulnerabilità su GitLab CE/EE
Rilasciati aggiornamenti di sicurezza che risolvono 24 vulnerabilità, di cui 1 con gravità “critica” e 5 con gravità “alta”, in GitLab Community Edition (CE) ed Enterprise Edition (EE). Tali vulnerabilità, qualora sfruttate, potrebbero consentire ad un utente malintenzionato, in determinate condizioni, di eseguire codice arbitrario, eludere dei meccanismi di sicurezza e accedere ad informazioni sensibili sui sistemi interessati.
-
· zachyceno · CERT-FR – avis FR
Multiples vulnérabilités dans GitLab (12 octobre 2026)
De multiples vulnérabilités ont été découvertes dans GitLab. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une atteinte à la confidentialité des données et une atteinte à l'intégrité des données.
-
· zachyceno · GitLab Security US
GitLab Critical Patch Release: 19.4.2, 19.3.4, 19.2.8
On October 8, 2026, we released versions 19.4.2, 19.3.4, 19.2.8 for GitLab Community Edition (CE) and Enterprise Edition (EE). These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action. GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch…