CVE-2026-93577: GitLab CE/EE RCE Vulnerability

CVE-2026-93577 Overview

CVE-2026-93577 is an integer overflow vulnerability [CWE-190] in GitLab Community Edition (CE) and Enterprise Edition (EE). The flaw resides in the regular expression compiler invoked during CI/CD configuration processing. An authenticated user who submits a specially crafted regular expression in a CI/CD configuration can trigger an integer overflow and execute arbitrary code on the GitLab server. The scope change in the CVSS vector reflects that successful exploitation impacts components beyond the vulnerable process, including hosted repositories, runners, and secrets accessible from the server. GitLab shipped fixes in versions 19.2.7, 19.3.3, and 19.4.1.

Critical Impact
An authenticated attacker can achieve arbitrary code execution on the GitLab server, exposing source code, CI/CD secrets, runner infrastructure, and connected supply-chain assets.

Affected Products

GitLab CE/EE versions 19.2 before 19.2.7
GitLab CE/EE versions 19.3 before 19.3.3
GitLab CE/EE versions 19.4 before 19.4.1

Discovery Timeline

2026-09-24 - CVE-2026-93577 published to the National Vulnerability Database
2026-09-28 - Last updated in NVD database

Technical Details for CVE-2026-93577

Vulnerability Analysis

The vulnerability resides in the component that compiles regular expressions supplied through CI/CD configuration files such as .gitlab-ci.yml. During compilation, an arithmetic operation on size or length values overflows, producing a smaller-than-expected allocation or an incorrect bounds value. Subsequent writes operate on an undersized buffer, corrupting adjacent memory. Attackers who control the regex contents can shape the overflowed state to redirect execution and run arbitrary code in the context of the GitLab server process.

The required privileges are low. Any authenticated user who can push a pipeline configuration or trigger pipeline parsing can reach the vulnerable code path. Because the GitLab server orchestrates jobs, holds CI/CD variables, and brokers access to Git repositories, code execution on the server collapses the trust boundary across every tenant, project, and connected runner.

Root Cause

The root cause is an integer overflow [CWE-190] in the regex compilation routine. Length or capacity arithmetic performed on attacker-influenced regex metadata wraps around integer limits, producing invalid size calculations that downstream allocation and copy operations rely on without re-validation.

Attack Vector

Exploitation is network-reachable and requires only a low-privileged authenticated account. The attacker commits a crafted CI/CD configuration containing the malicious regular expression, then triggers pipeline evaluation. When the server compiles the regex, the overflow fires, resulting in memory corruption and arbitrary code execution on the GitLab server host. No user interaction is required beyond the attacker's own actions.

No public proof-of-concept exploit was available at the time of publication. Technical detail is tracked in GitLab Work Item #629758 and HackerOne Report #3995696.

Detection Methods for CVE-2026-93577

Indicators of Compromise

Unexpected .gitlab-ci.yml commits containing unusually long, deeply nested, or malformed regular expressions in rules:if, only, except, or custom script blocks.
Pipeline parsing jobs or Rails worker processes (sidekiq, puma) crashing, restarting, or spawning unexpected child processes such as sh, bash, curl, or wget.
New or modified SSH keys, personal access tokens, or runner registration tokens created shortly after suspicious pipeline activity.
Outbound network connections from the GitLab application server to unfamiliar hosts following CI/CD configuration changes.

Detection Strategies

Audit recent commits to .gitlab-ci.yml and included CI templates for regex patterns with abnormal size, quantifiers, or escape sequences.
Correlate GitLab Rails and Sidekiq logs with host-level process telemetry to surface pipeline-triggered process executions that fall outside normal runner behavior.
Monitor GitLab audit events for low-privilege users who recently gained developer access and immediately modified pipeline configuration.

Monitoring Recommendations

Forward GitLab application, audit, and host logs into a centralized analytics platform and alert on anomalous child-process trees originating from GitLab service accounts.
Baseline normal pipeline parsing durations and alert on sustained CPU spikes or memory faults in the regex compilation path.
Enable runtime process and file-integrity monitoring on the GitLab server to detect post-exploitation activity such as web shell drops or token exfiltration.

How to Mitigate CVE-2026-93577

Immediate Actions Required

Upgrade GitLab CE/EE to 19.2.7, 19.3.3, or 19.4.1 or later as soon as possible.
Rotate CI/CD variables, runner registration tokens, deploy keys, and personal access tokens if the server ran a vulnerable version and exposure cannot be ruled out.
Review recent .gitlab-ci.yml changes across all projects for suspicious regex payloads and revert or quarantine untrusted commits.
Restrict project membership and developer-tier access on internet-facing GitLab instances until patches are applied.

Patch Information

GitLab addressed the issue in the 19.4.1 patch release along with backports to 19.3.3 and 19.2.7. See the GitLab Patch Release 19.4.1 advisory for upgrade instructions and verification steps. Self-managed administrators should follow the standard GitLab upgrade path for their installation method (Omnibus, Helm chart, source, or Docker).

Workarounds

No official workaround replaces patching; apply the vendor fix as the primary remediation.
As a temporary compensating control, limit who can push to default branches and require merge-request review before pipelines run against protected configurations.
Disable or gate pipeline execution on untrusted branches and forks until the upgrade is completed.

bash

# Example: upgrade an Omnibus GitLab installation on Debian/Ubuntu
sudo apt-get update
sudo apt-get install --only-upgrade gitlab-ee=19.4.1-ee.0
sudo gitlab-ctl reconfigure
sudo gitlab-rake gitlab:env:info