Alpine Linux rebuilds GitLab after attempted RCE attack
Hackers attempted to exploit a critical GitLab vulnerability in Alpine Linux's development infrastructure on October 20–21, prompting the open-source project to rebuild its GitLab server and reset all passwords over concerns of a possible compromise.
Hackers attempted to exploit a critical GitLab vulnerability in Alpine Linux's development infrastructure on October 20–21, prompting the open-source project to rebuild its GitLab server and reset all passwords over concerns of a possible compromise.
The attacks targeted CVE-2026-97229, a maximum-severity remote code execution flaw, repeatedly crashing GitLab processes, with some attempts coming close to succeeding.
CISA has tagged six GitLab vulnerabilities as exploited in the wild since November 2021, including two (tracked as CVE-2021-22175 and CVE-2021-39935) in February this year.
The Alpine Linux team found that the attackers downloaded its GitLab container image, suggesting they may have been preparing a supply-chain attack.
One day later, CISA added CVE-2026-85706 to its list of actively exploited flaws after cybersecurity firm watchTowr reported that attackers had already begun scanning the Internet for unpatched GitLab servers.
CVE-2026-97229 is a maximum-severity integer overflow vulnerability in GitLab’s CI/CD regular expression compiler Onigmo, bundled in Ruby, that could allow unauthenticated attackers to execute arbitrary code on the server.
GitLab disclosed the flaw and made fixes available on October 12, warning that attackers can trigger it under certain conditions by submitting a specially crafted regular expression in a CI/CD pipeline configuration.
Although Alpine Linux found no evidence that attackers executed code or tampered with its software packages and releases, it could not rule out a successful compromise due to missing logs and a lack of outbound connection records.
On Thursday, the US Cybersecurity and Infrastructure Security Agency (CISA) confirmed active exploitation and added CVE-2026-97229 to its Known Exploited Vulnerabilities (KEV) Catalog .
Alpine advises users to reset their GitLab passwords and pull the alpinelinux/gitlab:19.3.6 image published on October 27, which contains Ruby 3.3.13 and addresses CVE-2026-97229.
What happened
Hackers attempted to exploit a critical GitLab vulnerability in Alpine Linux's development infrastructure on October 20–21, prompting the open-source project to rebuild its GitLab server and reset all passwords over concerns of a possible compromise.
The attacks targeted CVE-2026-97229, a maximum-severity remote code execution flaw, repeatedly crashing GitLab processes, with some attempts coming close to succeeding.
What changed
CISA has tagged six GitLab vulnerabilities as exploited in the wild since November 2021, including two (tracked as CVE-2021-22175 and CVE-2021-39935) in February this year.
The Alpine Linux team found that the attackers downloaded its GitLab container image, suggesting they may have been preparing a supply-chain attack.
Who is affected
One day later, CISA added CVE-2026-85706 to its list of actively exploited flaws after cybersecurity firm watchTowr reported that attackers had already begun scanning the Internet for unpatched GitLab servers.
CVE-2026-97229 is a maximum-severity integer overflow vulnerability in GitLab’s CI/CD regular expression compiler Onigmo, bundled in Ruby, that could allow unauthenticated attackers to execute arbitrary code on the server.
Why it matters
GitLab disclosed the flaw and made fixes available on October 12, warning that attackers can trigger it under certain conditions by submitting a specially crafted regular expression in a CI/CD pipeline configuration.
Although Alpine Linux found no evidence that attackers executed code or tampered with its software packages and releases, it could not rule out a successful compromise due to missing logs and a lack of outbound connection records.
Technical details
On Thursday, the US Cybersecurity and Infrastructure Security Agency (CISA) confirmed active exploitation and added CVE-2026-97229 to its Known Exploited Vulnerabilities (KEV) Catalog .
Alpine advises users to reset their GitLab passwords and pull the alpinelinux/gitlab:19.3.6 image published on October 27, which contains Ruby 3.3.13 and addresses CVE-2026-97229.
Critical Linux kernel flaw allows remote root attacks on MPTCP servers
Response
A later upgrade to 19.3.6 also failed to close the flaw because the fix required a patch to Ruby, which GitLab bundled with its official packages but Alpine’s custom container image did not include.
Attackers have started exploiting a maximum-severity GitLab vulnerability patched earlier this month, according to the US Cybersecurity and Infrastructure Security Agency (CISA).
What security teams should do
Their GitLab instance hosts development repositories, code reviews, and CI jobs, including the "aports" build recipes used to produce Alpine’s software packages.
GitLab addressed the security issue in GitLab Community Edition (CE) and Enterprise Edition (EE) versions 19.4.2, 19.3.5, and 19.2.8 and urged admins to patch their servers immediately.
Attribution
BleepingComputer: Hackers attempted to exploit a critical GitLab vulnerability in Alpine Linux's development infrastructure on October 20–21, prompting the open-source project to rebuild its GitLab server and reset all passwords over concerns of a possible compromise.
BleepingComputer: Attackers have started exploiting a maximum-severity GitLab vulnerability patched earlier this month, according to the US Cybersecurity and Infrastructure Security Agency (CISA).
What to watch next
Watch for new exploitation reports and updated indicators of compromise.
Watch for updated vendor guidance and fixed-version details.