---
title: "Rapid7 turns GitLab's 10.0 flaw into a live product demo, three weeks before earnings"
description: "A 248-character regex can run commands on unpatched self-managed GitLab servers. Rapid7 reproduced the exploit a day after GitLab's October 12 patch and shipped detection to paying customers the same day, what looks like the first public run of the Intelligence unit it launched on October 2."
publisher: "The Inference"
section: "Safety"
published: 2026-10-16T01:38:40.867Z
modified: 2026-10-16T01:38:40.867Z
canonical: https://theinference.org/article/rapid7-turns-gitlab-s-10-0-flaw-into-a-live-product-demo-three-weeks-before-earnings
language: en
keywords: "Cybersecurity, Vulnerabilities, GitLab, Rapid7, Earnings"
---

# Rapid7 turns GitLab's 10.0 flaw into a live product demo, three weeks before earnings

> A 248-character regex can run commands on unpatched self-managed GitLab servers. Rapid7 reproduced the exploit a day after GitLab's October 12 patch and shipped detection to paying customers the same day, what looks like the first public run of the Intelligence unit it launched on October 2.

## A regex that walks past the guards

[GitLab](https://theinference.org/markets/companies/gitlab) [shipped an out-of-band patch](https://www.bleepingcomputer.com/news/security/gitlab-warns-of-max-severity-rce-flaw-in-regex-compiler-engine/), a security release outside its normal monthly schedule, on October 12 for CVE-2026-97229, an integer overflow it scored 10.0, the maximum on the CVSS severity scale [1][2]. The flaw sits in the compiler for regular expressions in CI/CD configurations, the pipelines that build and deploy software, across self-managed Community and Enterprise editions. It was one of 24 vulnerabilities fixed that day, and reached GitLab through a HackerOne bug-bounty report by a researcher working as joaxcar [2][3].

A day later, [Rapid7](https://theinference.org/markets/companies/rapid7) said it had [reproduced the whole chain on the official unpatched 19.4.1 Community Edition image](https://www.rapid7.com/blog/post/etr-cve-2026-97229-critical-unauthenticated-remote-code-execution-in-gitlab/) with address-space randomization enabled; the same input failed against patched 19.4.2 [1]. The route in is a two-stage pass: a crafted regular expression in a .gitlab-ci.yml pipeline file clears GitLab's validation, then recompiles against a repository path containing UTF-8 characters, where an integer overflow in Ruby's Onigmo engine hands the attacker control of the process.

## Twenty-four hours from patch to working exploit

Operating-system commands then run as the git user, the service account the GitLab application runs under [1]. [A public proof of concept](https://x.com/_CryptoCat/status/2110052018593362428) turns 248 characters into more than 2GB of engine code and reaches system() [4]. GitLab rates the bug fully unauthenticated; Rapid7's reproduction still needed a way to plant that configuration file first, a bar that disappears wherever an instance lets anyone register and open a public project [1].

## Self-managed servers hold source code and cloud credentials

What sits behind those servers is why a 10.0 here draws attackers fast: an organization's source code, its build pipelines and [the credentials those pipelines use to reach cloud accounts](https://theinference.org/article/two-dozen-firms-breached-through-gitlab-stored-secrets-and-gitlab-shipped-the-cure-a-day-later), in the words of Roman Y. Sannikov, global research coordinator at iCounter [5]. GitLab counts more than half the Fortune 100 among its customers [3].

This is GitLab's second maximum-severity flaw in two months. September's path-traversal bug, CVE-2026-85706, reached the exploited-vulnerabilities catalog kept by CISA, the U.S. cybersecurity agency, a day after GitLab patched it, and researchers at watchTowr were already logging probes [3][6]. "Teams should assume the window between disclosure and exploitation is days, not weeks," Sannikov said [5]. No exploitation of the new bug was confirmed as of October 13 [1].

## Same-day detection is the new unit's first product run

The timing is the business story. Rapid7 Intelligence, the unit [launched on October 2](https://finance.yahoo.com/technology/ai/articles/rapid7-launches-rapid7-intelligence-harness-130000040.html) to push vulnerability research straight into paid products, put an authenticated detection check for this flaw into its Exposure Command, Vulnerability Management and Nexpose products in the same October 13 content release [1][7]. For paying customers, that is the launch pitch in working code: research reaching product inside a day of a bug going public.

The Nasdaq-listed parent needs the demonstration. [Revenue fell 1.5 percent year over year in the June quarter](https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=0001560327), its second straight decline, and JPMorgan cut the stock to underweight in September with a $12 target [8][9]. [Third-quarter results land on November 4](https://www.marketscreener.com/news/rapid7-to-report-third-quarter-2026-financial-results-on-november-4-ce785dd2d181f526) [8].

*Chart: **Rapid7's growth has slid from 13 percent to two straight quarters of decline** Line chart of Rapid7's year-over-year revenue growth across twelve quarters, from 13.1 percent in Q3 2023 to minus 1.5 percent in Q2 2026, crossing below zero in 2026.*

*Year-over-year revenue growth by calendar quarter, as reported in Rapid7's SEC filings. Q2 '26 ended June 2026. [9]*

## GitLab grows 21 percent while Rapid7 shrinks

GitLab (NASDAQ: GTLB) is growing and exposed at once: [revenue rose 21.3 percent to $286.3 million in the quarter ended July](https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=0001653482), on a net loss of $36.8 million [10]. GitLab.com is already patched and customers on Dedicated, its hosted single-tenant offering, need do nothing, so the direct damage lands on customers' servers, not the vendor's books [1].

*Chart: **GitLab's revenue has grown more than 20 percent in all twelve quarters charted** Column chart of GitLab's quarterly revenue rising from $150 million in the quarter ended October 2023 to $286 million in the quarter ended July 2026, with year-over-year growth above 20 percent throughout.*

*Quarterly revenue in US$ millions, labelled by calendar quarter. GitLab's fiscal quarters end a month later than Rapid7's: its Q2 '26 ended July 31, 2026, the quarter the text cites at $286.3 million, up 21.3 percent. From GitLab's SEC filings. [11]*

## Upgrade now, then watch two dates

The patch targets are specific: 19.2.8, 19.3.5 and 19.4.2, installed now rather than at the next monthly cycle [1]. Where an upgrade must wait, GitLab advises restricting anonymous access to public projects and barring untrusted users from creating them [1]. On any instance that sat unpatched through the disclosure window, Sannikov's advice is to rotate CI/CD secrets and tokens and review runner and pipeline activity since disclosure [5].

Two markers will tell how this ends. One is whether CVE-2026-97229 follows its September sibling onto CISA's catalog [3][6]. The other is November 4, when Rapid7 reports third-quarter results and has to say whether Intelligence is showing up in paid-product uptake [8]. Until then, the exposure sits with whoever runs a forgotten self-managed instance.

## Takeaway

The 10.0 GitLab regex flaw is patched, but unpatched self-managed servers carry the risk, and Rapid7's same-day detection is the first working proof of the unit it launched on October 2.

## Sources

1. [Rapid7, CVE-2026-97229: Critical Unauthenticated Remote Code Execution in GitLab, 13 October 2026](https://www.rapid7.com/blog/post/etr-cve-2026-97229-critical-unauthenticated-remote-code-execution-in-gitlab/)
2. [eSecurity Planet, GitLab Warns of CVSS 10.0 Flaw That Could Allow Server Takeover, 13 October 2026](https://www.esecurityplanet.com/news/news-gitlab-critical-server-takeover-flaw/)
3. [BleepingComputer, GitLab warns of max severity code execution vulnerability, 12 October 2026](https://www.bleepingcomputer.com/news/security/gitlab-warns-of-max-severity-rce-flaw-in-regex-compiler-engine/)
4. [@_CryptoCat on X, Rapid7 PoC for CVE-2026-97229, 13 October 2026](https://x.com/_CryptoCat/status/2110052018593362428)
5. [SC Media, GitLab patches 10.0 flaw in its CE and EE products, 14 October 2026](https://www.scworld.com/news/gitlab-patches-10-0-flaw-in-its-ce-and-ee-products)
6. [TechRadar via MSN, CISA warns hackers are exploiting this max severity GitLab flaw, 14 September 2026](https://www.msn.com/en-us/technology/cybersecurity/cisa-warns-hackers-are-exploiting-this-max-severity-gitlab-flaw/ar-AA2ccpv4)
7. [Rapid7 press release via Yahoo Finance, Rapid7 Launches Rapid7 Intelligence to Harness Threat Data Against Attackers, 2 October 2026](https://finance.yahoo.com/technology/ai/articles/rapid7-launches-rapid7-intelligence-harness-130000040.html)
8. [GlobeNewswire via MarketScreener, Rapid7 to Report Third Quarter 2026 Financial Results on November 4, 14 October 2026 (page also carries the 15 September JPMorgan underweight call, $12 target)](https://www.marketscreener.com/news/rapid7-to-report-third-quarter-2026-financial-results-on-november-4-ce785dd2d181f526)
9. [Rapid7, quarterly figures from its SEC filings, retrieved 15 October 2026](https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=0001560327)
10. [GitLab, quarterly figures from its SEC filings, retrieved 15 October 2026](https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=0001653482)
11. [GitLab, quarterly figures from its SEC filings, retrieved 16 October 2026](https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=0001653482)


---

Rapid7 turns GitLab's 10.0 flaw into a live product demo, three weeks before earnings — The Inference. Canonical: https://theinference.org/article/rapid7-turns-gitlab-s-10-0-flaw-into-a-live-product-demo-three-weeks-before-earnings