Alpine Linux Rebuilds GitLab After Attempted Exploitation of Critical RCE Flaw
Summary
Alpine Linux rebuilt its GitLab server and reset passwords after attackers targeted CVE-2026-97229, causing worker crashes. It found no package tampering or confirmed code execution, but missing logs prevented ruling out compromise.
Key points
- Attackers submitted malicious CI configurations on October 20–21 targeting CVE-2026-97229, an unauthenticated RCE flaw in GitLab’s bundled Ruby Onigmo regular-expression compiler.
- The attempts caused eight worker crashes; Alpine said four were partially successful, but none appeared to complete.
- Alpine’s GitLab 19.3.6 upgrade did not fix the flaw because its custom container image lacked the required Ruby patch.
- Missing logs and outbound-connection records meant Alpine could not rule out code execution, so it rebuilt the GitLab server and reset all passwords.
- Alpine found no tampering in repository commits, packages, or releases through October 27; signing keys were not stored on the GitLab server.
- The attackers downloaded Alpine’s GitLab container image, which the team said could indicate preparation for a supply-chain attack.
- Alpine advised users to reset GitLab passwords and use its updated 19.3.6 image; exposure of user details, credentials, or private project data was not confirmed.
Article Details
- Victim Organization
- Alpine Linux
- Incident Type
- Attempted exploitation of a GitLab remote code execution vulnerability; a successful compromise could not be ruled out.
- Incident Date
- 2026-10-20
- Data Types Exposed
- Potentially exposed, but not confirmed: user details
- Potentially exposed, but not confirmed: password hashes
- Potentially exposed, but not confirmed: 2FA secrets
- Potentially exposed, but not confirmed: CI/CD secrets
- Potentially exposed, but not confirmed: integration credentials
- Potentially exposed, but not confirmed: private project content
- Operational Impact
- GitLab processes crashed during the attack, including eight worker crashes. Alpine Linux rebuilt its GitLab instance from scratch and reset all passwords. No tampering with repository commits, packages, or releases was found through October 27; successful code execution could not be ruled out.
- Claim Status
- unknown
MITRE ATT&CK
CVE
Vendors
Products
Alpine LinuxAlpine Linux rebuilds GitLab after attempted RCE attackGitLabAlpine Linux rebuilds GitLab after attempted RCE attackRubyinteger overflow vulnerability in GitLab’s CI/CD regular expression compiler Onigmo, bundled in Ruby, that could allow unauthenticated attackers to execute arbitrary code on the server.