Alpine Linux Rebuilt GitLab Server After Attempted CVE-2026-97229 Exploitation
Summary
Alpine Linux rebuilt its GitLab server after reported attempts to exploit CVE-2026-97229. It found no evidence of code execution but cannot rule it out. GitLab installations using separate Ruby must update Ruby to a fixed version.
Key points
- Alpine said an account probed its unpatched GitLab server with crafted CI configurations on 20 and 21 October, crashing worker processes eight times.
- In four crashes, the attacker reportedly progressed partway through the exploit. Alpine found no evidence that code ran, but missing logs and outbound-network records prevent it from ruling out successful execution.
- Alpine treated the server as potentially compromised, rebuilt it, replaced its secret keys, and reset account passwords. It has not said whether stored runner tokens or other credentials were replaced.
- CVE-2026-97229 affects Ruby’s Onigmo regular-expression engine. GitLab’s bundled Ruby patches do not fix installations using a separate Ruby; those require a fixed Ruby version.
- Alpine checked package changes against a developer’s repository copy and its build servers. It said the package-signing keys were never stored on the GitLab server.
- Rapid7’s lab exploit required write access to a public project for its tested route. Alpine has not said how the attacker’s CI configurations reached its server.
Article Details
- Victim Organization
- Alpine Linux
- Victim Domain
- gitlab.alpinelinux.org
- Incident Type
- Attempted exploitation of CVE-2026-97229, a GitLab remote code execution vulnerability. The attacker’s configurations crashed GitLab worker processes, but Alpine found no evidence that code execution succeeded and could not rule it out.
- Incident Date
- 2026-10-20
- Disclosure Date
- 2026-10-28
- Data Types Exposed
- Runner tokens (potential exposure if the exploit succeeded)
- CI/CD variables (potential exposure if the exploit succeeded)
- Access tokens (potential exposure if the exploit succeeded)
- Integration credentials (potential exposure if the exploit succeeded)
- Operational Impact
- The attacker’s CI configurations crashed GitLab worker processes eight times; the main attack also caused 502 errors and CI job failures. Alpine closed the server to the public, rebuilt it, replaced its secret keys, and reset account passwords. Alpine found no evidence of successful code execution but treated the server as potentially compromised because some logs and other evidence were unavailable.
- Ransom Or Extortion
- Unknown
- Claim Status
- unknown