Attacker tried to exploit critical GitLab flaw CVE-2026-97229 at Alpine Linux. Upgrading GitLab alone may not fix it on custom Ruby builds

In brief

Developing. Last updated 29 October 2026, 09:20 Dubai time (UTC+4).

Alpine Linux said on 28 October 2026 that an attacker tried to exploit CVE-2026-97229, a critical GitLab vulnerability, on its GitLab instance on 20 and 21 October. Alpine says it found no evidence that the attack succeeded but cannot rule it out, so it treated the instance as compromised and rebuilt it. It says its aports repository, packages and 21 October releases were not tampered with.

The vulnerability

• What it is. GitLab says the flaw could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration.
• Severity. GitLab rates it critical, with a CVSS 3.1 score of 10.0. NVD lists the same score.
• Affected and fixed. GitLab CE/EE from 19.2 before 19.2.8, 19.3 before 19.3.5 and 19.4 before 19.4.2, according to GitLab and NVD. GitLab released fixes on 12 October; it says GitLab.com and Dedicated are patched.
• The Ruby catch. Alpine says the underlying bug is in Onigmo, Ruby's regular expression engine, and GitLab's fix is a set of Ruby patches applied only in its own packages and images. GitLab's release notes list Ruby regexp patches in each fixed version. Upstream Ruby shipped the fix on 23 October in Ruby 3.3.13, 3.4.12 and 4.0.9, Alpine says.

What happened at Alpine

According to Alpine, its instance was still on 19.3.4. A newly registered account sent crafted CI configurations that crashed GitLab worker processes eight times; in four crashes the attacker got partway through the exploit and failed at the next step. Alpine's 22 October upgrade to 19.3.6 did not fix the flaw because its image used standard Ruby. The attacker also downloaded Alpine's GitLab container image, "which suggests they were tuning the exploit to our exact build," Alpine says. The attacker's account was blocked on 23 October, and attempts to return on 25 and 26 October failed. Alpine says no signing keys were exposed and all GitLab passwords have been reset.

This is an attempted exploitation reported by Alpine. Neither GitLab nor Alpine reports a confirmed successful compromise.

What admins should do

• Upgrade now. GitLab recommends that self-managed installations move to 19.4.2, 19.3.5 or 19.2.8 immediately.
• Check your Ruby. Alpine says anyone running GitLab with their own Ruby, from source or a custom image, also needs Ruby 3.3.13, 3.4.12, 4.0.9 or later. Users of the alpinelinux/gitlab image should pull 19.3.6 again; Alpine says only the image published on 27 October contains the fix.
• Hunt for attempts. GitLab has published six threat detections, including worker crashes tied to Onigmo and hostile CI lint regular expressions.

The two points below are ByteNib analysis.

• Treat crashes as signals. Alpine's evidence of attack was repeated worker crashes. Review CI lint traffic and crash logs from 12 October onward.
• Restrict sign-ups. The attack started from a newly registered account. Limit open registration on public instances.

Sources and scope

• GitLab, "GitLab Critical Patch Release: 19.4.2, 19.3.5, 19.2.8", 12 October 2026: description, severity, affected and fixed versions, Ruby patches, recommended action and detections.
• Alpine Linux, "GitLab security incident: attempted exploitation of CVE-2026-97229", 28 October 2026: the attack, timeline, findings, Ruby fix versions and image guidance.
• NVD, CVE-2026-97229, published 13 October 2026: affected versions and CVSS score.

Attack details are Alpine's own account and have not been independently verified. Guidance labelled as analysis is ByteNib editorial analysis. This article was researched and drafted with AI assistance and edited under ByteNib's editorial standards.

Drafted with AI assistance and reviewed by the editor before publication.

Continue exploring: Cybersecurity analysis, the related implementation tutorial, and the structured learning path.