WORLDTECHAlpine Linux Targeted With Exploit for Max-Severity GitLab Flaw
Alpine Linux says a threat actor tried to exploit CVE-2026-97229, a maximum-severity flaw in GitLab, against its own GitLab instance on October 20 and 21. The attack failed, but the Linux distribution rebuilt the instance from scratch and reset all passwords.
How the attack unfolded
According to Alpine Linux, the attackers used a newly registered account to send crafted CI configurations to its GitLab instance, which crashed the worker process. The distribution reports that the attempt failed.
Alpine Linux is still testing the GitLab instance before public release. It has also reset all passwords, warning of automated login attempts that use passwords compromised in other leaks.
A flaw rooted in Ruby
GitLab described the bug in an October 12 advisory, saying it "could have allowed an unauthenticated user to execute arbitrary code on the GitLab server" through a specially crafted regular expression in a CI/CD configuration. The flaw, tracked as CVE-2026-97229 with a CVSS score of 10/10, stems from insufficient regular expression validation in Onigmo, Ruby's regular expression engine.
Because the underlying vulnerability sits in Ruby rather than in GitLab itself, Alpine Linux says it was not patched by updating to GitLab 19.3.6. The distribution's image runs standard Ruby, so the fix requires more than a GitLab upgrade.
Government response
On Thursday, the US cybersecurity agency CISA added CVE-2026-97229 to its Known Exploited Vulnerabilities catalogue. It urged federal agencies to patch the flaw within three days, as mandated by BOD 26-04.
Alpine Linux advises that operators running GitLab with their own Ruby, whether built from source or in a custom container image, must also install Ruby 3.3.13, 3.4.12, 4.0.9 or later.
Open questions
- Which other GitLab deployments running their own Ruby remain unpatched?
- Did the attacker gain any access beyond crashing the worker process?