SecurityWeekIonut Arghire
Alpine Linux foils exploit attempt targeting GitLab vulnerability
Part of the CVE-2026-97229 story · since 12 Oct
- Mon 12 Oct, 09:11 UTC. SecurityOnline, first report. Critical GitLab flaw lets unauthenticated attackers run code on servers. Cites a CVE in CISA KEV.
- Tue 13 Oct, 09:12 UTC. The Hacker News, its first report on the story. GitLab Patches Critical Flaw That Could Let Attackers Run Server Code. Cites a CVE in CISA KEV.
- Tue 13 Oct, 12:50 UTC. Rapid7, its first report on the story. GitLab fixes critical flaw that lets attackers execute code via CI/CD regexes. Cites a CVE in CISA KEV.
- Tue 13 Oct, 13:28 UTC. SOCRadar, its first report on the story. GitLab rushes to patch critical flaw enabling unauthenticated server takeover. Cites a CVE in CISA KEV.
- Tue 13 Oct, 14:37 UTC. Security Affairs, its first report on the story. GitLab patches critical flaw letting attackers run code without logging in. Cites a CVE in CISA KEV.
- Wed 14 Oct, 11:01 UTC. SecurityOnline. Critical GitLab CI flaw enables unauthenticated remote code execution. Cites a CVE in CISA KEV.
- Fri 16 Oct, 15:37 UTC. Rapid7. GitLab fixes critical CI/CD flaw enabling unauthenticated remote code execution. Cites a CVE in CISA KEV.
- Mon 26 Oct, 03:21 UTC. SecurityOnline. Ruby fixes regex flaws that could enable GitLab server attacks. Cites a CVE in CISA KEV.
- Thu 29 Oct, 00:00 UTC. SecurityOnline. Attackers Target Alpine Linux GitLab With CVSS 10 RCE Flaw. Cites a CVE in CISA KEV.
- Thu 29 Oct, 12:01 UTC. The Hacker News. Attacker Targets Alpine Linux GitLab Server With CVE-2026-97229. Cites a CVE in CISA KEV.
- Thu 29 Oct, 20:00 UTC. CISA, its first report on the story. CISA Adds Actively Exploited GitLab Code Execution Flaw to KEV. Cites a CVE in CISA KEV.
- Fri 30 Oct, 08:30 UTC. The Hacker News. CISA Adds Exploited GitLab and Cisco Flaws to KEV. Cites a CVE in CISA KEV.
- Fri 30 Oct, 10:30 UTC. SecurityWeek, its first report on the story. Alpine Linux foils exploit attempt targeting GitLab vulnerability. Cites a CVE in CISA KEV. This article, 13th of 13.
SecurityWeek reports that a max-severity vulnerability in GitLab, tracked as CVE-2026-97229 with a CVSS score of 10/10, stemmed from insufficient regular expression validation in Onigmo, Ruby’s regex engine. The flaw could allow an unauthenticated attacker to execute arbitrary code on a GitLab server via a specially crafted regular expression in a CI/CD configuration, according to an October advisory from GitLab.
Alpine Linux later disclosed that a threat actor targeted its GitLab instance with an exploit for CVE-2026-97229 on 20–21 October. The attempt was unsuccessful, and Alpine rebuilt its GitLab instance from scratch; the aports repository, packages and the 21 October releases were not tampered with, the distribution confirmed.
Alpine Linux also noted that the attack utilised a newly registered account to push crafted CI configurations to its GitLab instance, crashing the worker process. In four crashes the attacker got partway through the exploit but did not complete the final step, and the attacker downloaded Alpine’s GitLab container image, suggesting intent to tune the exploit to the exact build. There is no evidence that code was executed on the server, though the possibility cannot be ruled out.
Because the vulnerability resides in Ruby rather than GitLab itself, Alpine warned that updating to GitLab 19.3.6 alone may be insufficient for users running their own Ruby installations; if Ruby is sourced separately, users should upgrade to Ruby 3.3.13, 3.4.12, 4.0.9 or later. The US CISA has added CVE-2026-97229 to its Known Exploited Vulnerabilities catalog, urging federal agencies to patch within three days under directive BOD 26-04.
How the story developed
13 articles from 7 outlets since 12 Oct. Picked up again on 29 Oct after 3 days quiet. This was the 13th report, 18 days after the first.
- Mon 12 Oct, 09:11 UTC. SecurityOnline, first report. Critical GitLab flaw lets unauthenticated attackers run code on servers. Cites a CVE in CISA KEV.
- Tue 13 Oct, 09:12 UTC. The Hacker News, its first report on the story. GitLab Patches Critical Flaw That Could Let Attackers Run Server Code. Cites a CVE in CISA KEV.
- Tue 13 Oct, 12:50 UTC. Rapid7, its first report on the story. GitLab fixes critical flaw that lets attackers execute code via CI/CD regexes. Cites a CVE in CISA KEV.
- Tue 13 Oct, 13:28 UTC. SOCRadar, its first report on the story. GitLab rushes to patch critical flaw enabling unauthenticated server takeover. Cites a CVE in CISA KEV.
- Tue 13 Oct, 14:37 UTC. Security Affairs, its first report on the story. GitLab patches critical flaw letting attackers run code without logging in. Cites a CVE in CISA KEV.
- Wed 14 Oct, 11:01 UTC. SecurityOnline. Critical GitLab CI flaw enables unauthenticated remote code execution. Cites a CVE in CISA KEV.
- Fri 16 Oct, 15:37 UTC. Rapid7. GitLab fixes critical CI/CD flaw enabling unauthenticated remote code execution. Cites a CVE in CISA KEV.
- Mon 26 Oct, 03:21 UTC. SecurityOnline. Ruby fixes regex flaws that could enable GitLab server attacks. Cites a CVE in CISA KEV.
- Thu 29 Oct, 00:00 UTC. SecurityOnline. Attackers Target Alpine Linux GitLab With CVSS 10 RCE Flaw. Cites a CVE in CISA KEV.
- Thu 29 Oct, 12:01 UTC. The Hacker News. Attacker Targets Alpine Linux GitLab Server With CVE-2026-97229. Cites a CVE in CISA KEV.
- Thu 29 Oct, 20:00 UTC. CISA, its first report on the story. CISA Adds Actively Exploited GitLab Code Execution Flaw to KEV. Cites a CVE in CISA KEV.
- Fri 30 Oct, 08:30 UTC. The Hacker News. CISA Adds Exploited GitLab and Cisco Flaws to KEV. Cites a CVE in CISA KEV.
- Fri 30 Oct, 10:30 UTC. SecurityWeek, its first report on the story. Alpine Linux foils exploit attempt targeting GitLab vulnerability. Cites a CVE in CISA KEV. This article, 13th of 13.
- Known exploited CVE
- No CVE
- Larger: an outlet’s first report
- Square: official source
- Coverage over time
- Quiet time, folded
Show all 13 articles as a listHide the list
- Mon 12 OctDay 01
- Critical GitLab flaw lets unauthenticated attackers run code on servers09:11 · SecurityOnline · First report · Exploited CVE · Known exploited CVE
- Tue 13 OctDay 14
- GitLab Patches Critical Flaw That Could Let Attackers Run Server Code09:12 · The Hacker News · Known exploited CVE
- GitLab fixes critical flaw that lets attackers execute code via CI/CD regexes12:50 · Rapid7 · Known exploited CVE
- GitLab rushes to patch critical flaw enabling unauthenticated server takeover13:28 · SOCRadar · Known exploited CVE
- GitLab patches critical flaw letting attackers run code without logging in14:37 · Security Affairs · Known exploited CVE
- Wed 14 OctDay 21
- Critical GitLab CI flaw enables unauthenticated remote code execution11:01 · SecurityOnline · Known exploited CVE
Quiet for 2 days
Fri 16 OctDay 41- GitLab fixes critical CI/CD flaw enabling unauthenticated remote code execution15:37 · Rapid7 · Picked up again · Known exploited CVE
Quiet for 9 days
Mon 26 OctDay 141- Ruby fixes regex flaws that could enable GitLab server attacks03:21 · SecurityOnline · Picked up again · Known exploited CVE
Quiet for 3 days
Thu 29 OctDay 173- Attackers Target Alpine Linux GitLab With CVSS 10 RCE Flaw00:00 · SecurityOnline · Picked up again · Known exploited CVE
- Attacker Targets Alpine Linux GitLab Server With CVE-2026-9722912:01 · The Hacker News · Known exploited CVE
- CISA Adds Actively Exploited GitLab Code Execution Flaw to KEV20:00 · CISA · official · CISA alert · Known exploited CVE
- Fri 30 OctDay 182
- Alpine Linux foils exploit attempt targeting GitLab vulnerability10:30 · SecurityWeek · Known exploited CVE · This article, 13th of 13