Attacker Targets Alpine Linux GitLab Server With CVE-2026-97229

An attacker attempted to exploit a critical GitLab vulnerability on Alpine Linux’s own GitLab server, tracked as CVE-2026-97229 with a CVSS score of 10.0. The flaw could allow an unauthenticated remote code execution via a crafted regular expression in CI configurations, exploiting Onigmo, the regex engine embedded in Ruby. Alpine said there was no definitive evidence the attack succeeded, but because it could not be ruled out, the Alpine team rebuilt the server from scratch and reset every user password.

GitLab’s patches address the issue by updating the Ruby components it ships in its packages and container images; however, Alpine noted that upgrading GitLab alone is not sufficient for servers running self‑contained Ruby, which must also be updated to Ruby 3.3.13, 3.4.12, 4.0.9 or later, and Alpine users of the alpinelinux/gitlab image should pull 19.3.6 again.

Alpine’s account of the event shows the timeline began with a 13 October upgrade to GitLab 19.3.4 (instead of 19.3.5), followed by a newly registered account probing from 20 October. Attacker‑sent, crafted CI configurations caused GitLab worker crashes on 20–21 October, with 502 errors and CI job failures. In four crashes, the attacker advanced partway through the exploit before being blocked; the intruder also downloaded Alpine’s GitLab container image, suggesting pursuit of a build‑specific exploit.

Alpine blocked the account on 23 October, and although attempts resumed on 25–26 October, defence held. By 28 October the server was rebuilt and GitLab was closed to the public while Alpine tested Ruby 3.3.13 or later before reopening. Rapid7 later built a working exploit in a lab demonstrating unauthenticated RCE on unpatched 19.4.1 images, but not on patched 19.4.2 images, noting a required write step to a public project path.

If a breach occurred, data potentially exposed could include email addresses, names and IPs, password hashes, secrets and tokens, and private repositories. Alpine also highlighted that the attack could have impacted servers using self‑compiled Ruby or non‑patched images.