GitLab CE/EE Unauthenticated RCE via Crafted CI/CD Regular Expression (CVE-2026-97229)

// df00tech DF00-142016b516 · https://df00tech.com/detections/CVE-2026-97229 · licence: https://df00tech.com/detections/licence
let lookback = 24h;
Syslog
| where TimeGenerated >= ago(lookback)
| where ProcessName in~ ("puma", "sidekiq", "gitlab-rails", "ruby")
| where SyslogMessage has_any ("/bin/sh", "/bin/bash", "curl ", "wget ", "nc ", "python")
| summarize Events = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Sample = take_any(SyslogMessage) by Computer, ProcessName
| order by LastSeen desc

``` df00tech DF00-142016b516 · https://df00tech.com/detections/CVE-2026-97229 · licence: https://df00tech.com/detections/licence ```
index=gitlab (sourcetype="gitlab:production_json" OR sourcetype="gitlab:api_json" OR sourcetype="syslog") earliest=-24h
| eval regex_len=len(coalesce('params{}.value', uri_query, ""))
| where match(_raw, "(?i)(ci_config|\.gitlab-ci|regex|regexp)") AND (regex_len>2000 OR match(_raw, "(\([^)]*[+*][^)]*\)[+*]){2,}"))
| stats count AS events values(uri_path) AS paths latest(_time) AS lastSeen earliest(_time) AS firstSeen BY host, remote_ip
| convert ctime(firstSeen) ctime(lastSeen)
| sort - lastSeen

// df00tech DF00-142016b516 · https://df00tech.com/detections/CVE-2026-97229 · licence: https://df00tech.com/detections/licence
process where event.type == "start" and process.parent.name : ("puma*", "sidekiq*", "ruby", "gitlab-rails") and process.name : ("sh", "bash", "curl", "wget", "nc", "python*", "perl") and user.name : "git"

-- df00tech DF00-142016b516 · https://df00tech.com/detections/CVE-2026-97229 · licence: https://df00tech.com/detections/licence
SELECT sourceip, username, QIDNAME(qid) AS event_name, UTF8(payload) AS raw, DATEFORMAT(starttime,'yyyy-MM-dd HH:mm:ss') AS event_time FROM events WHERE LOGSOURCETYPENAME(devicetype) ILIKE '%gitlab%' AND (UTF8(payload) ILIKE '%ci_config%' OR UTF8(payload) ILIKE '%.gitlab-ci%') AND (UTF8(payload) ILIKE '%regexp%' OR UTF8(payload) ILIKE '%regex%') ORDER BY starttime DESC LAST 24 HOURS

// df00tech DF00-142016b516 · https://df00tech.com/detections/CVE-2026-97229 · licence: https://df00tech.com/detections/licence
_sourceCategory=*gitlab* 
| where _raw matches /(?i)(ci_config|\.gitlab-ci)/ and _raw matches /(?i)(regex|regexp)/
| count by _sourceHost, _sourceCategory
| sort by _count desc

// df00tech DF00-142016b516 · https://df00tech.com/detections/CVE-2026-97229 · licence: https://df00tech.com/detections/licence
rule gitlab_rails_spawn_shell_cve_2026_97229 {
  meta:
    author = "Argus"
    description = "GitLab Rails, Puma or Sidekiq worker launching a shell or download tool (CVE-2026-97229)"
    severity = "CRITICAL"
  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    re.regex($e.principal.process.command_line, `(puma|sidekiq|gitlab-rails)`) nocase
    re.regex($e.target.process.file.full_path, `/(sh|bash|curl|wget|nc|python[0-9.]*)$`)
    $host = $e.principal.hostname
  match:
    $host over 1h
  condition:
    $e
}

// df00tech DF00-142016b516 · https://df00tech.com/detections/CVE-2026-97229 · licence: https://df00tech.com/detections/licence
#event_simpleName=ProcessRollup2 event_platform=Lin
| ParentBaseFileName=/^(puma|sidekiq|ruby|gitlab-rails)/i
| FileName=/^(sh|bash|curl|wget|nc|python[0-9.]*|perl)$/i
| UserName=git
| table([_time, aid, ComputerName, ParentBaseFileName, FileName, CommandLine])