Rapid7 turns GitLab's 10.0 flaw into a live product demo, three weeks before earnings

A regex that walks past the guards

GitLab▲+2.88% — GitLab, up 2.88 percent today shipped an out-of-band patch↗, a security release outside its normal monthly schedule, on October 12 for CVE-2026-97229, an integer overflow it scored 10.0, the maximum on the CVSS severity scale ¹². The flaw sits in the compiler for regular expressions in CI/CD configurations, the pipelines that build and deploy software, across self-managed Community and Enterprise editions. It was one of 24 vulnerabilities fixed that day, and reached GitLab through a HackerOne bug-bounty report by a researcher working as joaxcar ²³.

A day later, Rapid7▲+6.22% — Rapid7, up 6.22 percent today said it had reproduced the whole chain on the official unpatched 19.4.1 Community Edition image↗ with address-space randomization enabled; the same input failed against patched 19.4.2 ¹. The route in is a two-stage pass: a crafted regular expression in a .gitlab-ci.yml pipeline file clears GitLab's validation, then recompiles against a repository path containing UTF-8 characters, where an integer overflow in Ruby's Onigmo engine hands the attacker control of the process.

Twenty-four hours from patch to working exploit

Operating-system commands then run as the git user, the service account the GitLab application runs under ¹. A public proof of concept↗ turns 248 characters into more than 2GB of engine code and reaches system() ⁴. GitLab rates the bug fully unauthenticated; Rapid7's reproduction still needed a way to plant that configuration file first, a bar that disappears wherever an instance lets anyone register and open a public project ¹.

Self-managed servers hold source code and cloud credentials

What sits behind those servers is why a 10.0 here draws attackers fast: an organization's source code, its build pipelines and the credentials those pipelines use to reach cloud accounts, in the words of Roman Y. Sannikov, global research coordinator at iCounter ⁵. GitLab counts more than half the Fortune 100 among its customers ³.

This is GitLab's second maximum-severity flaw in two months. September's path-traversal bug, CVE-2026-85706, reached the exploited-vulnerabilities catalog kept by CISA, the U.S. cybersecurity agency, a day after GitLab patched it, and researchers at watchTowr were already logging probes ³⁶. "Teams should assume the window between disclosure and exploitation is days, not weeks," Sannikov said ⁵. No exploitation of the new bug was confirmed as of October 13 ¹.

Same-day detection is the new unit's first product run

The timing is the business story. Rapid7 Intelligence, the unit launched on October 2↗ to push vulnerability research straight into paid products, put an authenticated detection check for this flaw into its Exposure Command, Vulnerability Management and Nexpose products in the same October 13 content release ¹⁷. For paying customers, that is the launch pitch in working code: research reaching product inside a day of a bug going public.

The Nasdaq-listed parent needs the demonstration. Revenue fell 1.5 percent year over year in the June quarter↗, its second straight decline, and JPMorgan cut the stock to underweight in September with a $12 target ⁸⁹. Third-quarter results land on November 4↗ ⁸.

GitLab grows 21 percent while Rapid7 shrinks

GitLab (NASDAQ: GTLB) is growing and exposed at once: revenue rose 21.3 percent to $286.3 million in the quarter ended July↗, on a net loss of $36.8 million ¹⁰. GitLab.com is already patched and customers on Dedicated, its hosted single-tenant offering, need do nothing, so the direct damage lands on customers' servers, not the vendor's books ¹.

Upgrade now, then watch two dates

The patch targets are specific: 19.2.8, 19.3.5 and 19.4.2, installed now rather than at the next monthly cycle ¹. Where an upgrade must wait, GitLab advises restricting anonymous access to public projects and barring untrusted users from creating them ¹. On any instance that sat unpatched through the disclosure window, Sannikov's advice is to rotate CI/CD secrets and tokens and review runner and pipeline activity since disclosure ⁵.

Two markers will tell how this ends. One is whether CVE-2026-97229 follows its September sibling onto CISA's catalog ³⁶. The other is November 4, when Rapid7 reports third-quarter results and has to say whether Intelligence is showing up in paid-product uptake ⁸. Until then, the exposure sits with whoever runs a forgotten self-managed instance.