Alpine Linux rebuilds GitLab and resets passwords after CVE-2026-97229 exploit attempts

Alpine Linux tore down and rebuilt its GitLab platform at gitlab.alpinelinux.org on Oct. 27, 2026, and forced a reset of every account password by Oct. 28 after repeated attempts to exploit CVE-2026-97229. The project said it found no evidence the attacker succeeded but cannot rule out code execution on the server.

A newly registered account probed the platform on Oct. 20 and 21, 2026, sending crafted CI configurations that crashed worker processes eight times. In four of those crashes, the attacker moved partway through the exploit chain before failing at the next step. The Oct. 21 attack also caused 502 errors and failed CI jobs.

Alpine blocked the account on Oct. 23, 2026, though the same attacker came back on Oct. 25 and 26 without succeeding. The project learned on Oct. 26 that its Oct. 22 upgrade to GitLab 19.3.6 had not closed the vulnerability. It shut GitLab down on Oct. 27, rebuilt from scratch, and completed password resets and secret-key replacements by Oct. 28. GitLab was open again by Oct. 30.

The remediation failed at first because Alpine moved to GitLab 19.3.4 on Oct. 13, 2026, though it intended to install 19.3.5. Its Oct. 22 upgrade to 19.3.6 did not help because the image used standard Ruby rather than GitLab’s patched build. The fix is a patch to Ruby rather than GitLab application code, so upgrading GitLab does not protect installations that use their own Ruby.

CVE-2026-97229 carries a CVSS score of 10.0 and is an integer overflow in Onigmo, Ruby’s regular expression engine. The flaw lets an unauthenticated user run arbitrary code on self-managed GitLab instances through a specially crafted regular expression in a CI/CD configuration.

Ruby maintainers say the bug reaches only programs that compile regular expressions from attacker-controlled text, and Regexp.timeout offers no protection. Short patterns can trigger some of the issues, so limiting pattern length is not a reliable defense. If an upgrade is impossible, Ruby says to avoid compiling regular expressions from untrusted input.

GitLab released fixed versions 19.2.8, 19.3.5, and 19.4.2 on Oct. 12, 2026, by bundling a patched Ruby in its official packages and container images. Upstream Ruby shipped fixes in Ruby 3.3.13, 3.4.12, and 4.0.9 on Oct. 23, 2026.

Administrators using self-compiled GitLab face a harder problem. GitLab’s installation guide still names Ruby 3.2 as the minimum version, and Ruby 3.2 reached end of life in April and will not receive the fix. Defenders should verify both the GitLab release and the Ruby runtime actually used by the running service, because an interactive shell check may not reflect the runtime GitLab launches.

Alpine’s own packages include the fix. Ruby 3.4.12 is available on Alpine 3.22, 3.23, 3.24, and edge, while Ruby 3.3.13 on Alpine 3.21 includes the fix and is installable through apk upgrade.

CISA added CVE-2026-97229 to its Known Exploited Vulnerabilities catalog on Oct. 29, 2026. The entry names GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability, cites weakness class CWE-190, sets forensicTriage to Yes, and sets the known ransomware campaign use field to Unknown. It requires mitigations per vendor instructions under BOD 26-04 and gives federal agencies three days between the listing and the Nov. 1 due date.

The catalog’s Oct. 28 update did not include the flaw, so its absence should not be read as proof that exploitation is impossible or that vulnerable servers are safe. CISA also says cloud services should follow applicable BOD 26-04 guidance or discontinue use if mitigations are unavailable, and that stakeholders must evaluate each asset’s internet exposure.

Alpine checked its aports tree, packages, and releases and found no tampering in releases 3.21.9, 3.22.7, 3.23.7, and 3.24.3. It also found no tampering in packages built Oct. 20 to 24, 2026. Every aports commit added Oct. 20 to 22 came through a recorded push by a known developer, and Alpine verified builds against commits published on git.alpinelinux.org using a developer’s clone and all 45 builders.

No package-signing keys resided on the GitLab server at any time, which Alpine said kept the incident from becoming a comparable supply-chain event. Alpine plans to sign release tags going forward.

Data potentially exposed if the exploit succeeded included e-mail addresses, names, IP addresses, password hashes, and two-factor authentication secrets. Other potentially exposed material included CI/CD variables, runner tokens, webhook and mirror credentials, personal access token hashes, and private repositories. Alpine has not said whether it rotated credentials such as runner tokens, CI/CD variables, access tokens, or integration credentials after the password and secret-key resets.

Alpine also saw automated login attempts against its GitLab that used passwords leaked from other breaches.

Missing relevant logs and absent outbound traffic logging mean Alpine cannot prove code never ran on the server. Logs from the attack day were missing, including background job logs and the previous container filesystem, and neither Alpine nor its host recorded outbound connections. A successful exploit would not produce a crash or any trace in web logs.

The attacker downloaded Alpine’s GitLab container image apparently to tune the exploit against the exact build, though Alpine described that as its own inference rather than an established fact. Alpine reissued the alpinelinux/gitlab:19.3.6 container image on Oct. 27, 2026, containing Ruby 3.3.13, while older pulls of that tag remain vulnerable. The tag name alone cannot establish whether the fix is present.

Rapid7 researchers achieved arbitrary code execution on an unpatched GitLab CE 19.4.1 image on Oct. 13, 2026, and the same input did not work on patched GitLab CE 19.4.2. Rapid7 said on Oct. 13 that it had seen no confirmed exploitation of CVE-2026-97229 in the wild. Its lab proof requires a malicious.gitlab-ci.yml file and a repository path containing UTF-8 characters committed to a branch of a public project.

GitLab released six Sigma-format detection rules for self-managed servers, including rules targeting Onigmo worker crashes and GraphQL ciLint requests, with four marked experimental.

Rapid7 recommends that organizations upgrade affected self-managed GitLab instances urgently, outside their normal patch cycles. For installations that cannot be patched right away, Rapid7 suggests restricting public-project visibility, preventing untrusted accounts from writing to public repositories, and disabling the CI lint endpoint as interim measures. It cautioned that those steps address only the attack path it demonstrated and leave the core regex defect unresolved.

GitLab said its hosted services needed no customer action, stating, “GitLab.com is already running the patched version.”

A researcher using the handle joaxcar reported the flaw through GitLab’s HackerOne bug bounty program. CVE-2026-97229 circumvents a prior patch for CVE-2026-93577. GitLab’s advisory initially named 19.3.4 as the fixed version on Oct. 12 before later listing 19.3.5 as fixed and 19.3.4 as affected.

Alpine plans to apply critical patches within one day and enhance logging. It will keep logs for more than 14 days and will log outbound connections from the GitLab host and database connections. While Alpine kept GitLab closed to public logins, Alpine’s package mirrors, cgit, and mailing lists and IRC remained available as normal.