GitLab Security Incident: Attempted Exploitation of CVE-2026-97229
Alpine Linux rebuilds GitLab instance following a critical vulnerability exploitation attempt on CI configurations.
1Incident Detection and Response
On October 20 and 21, attackers attempted to exploit CVE-2026-97229 against the Alpine Linux GitLab instance. Although no definitive evidence of successful code execution was found, the team treated the system as compromised. Consequently, they rebuilt the entire instance from scratch to eliminate any potential persistent footholds left by the attacker.
2Vulnerability Mechanics Explained
The critical CVSS 10.0 vulnerability resides in the Onigmo regular expression engine within Ruby. It affects how GitLab processes CI configurations from untrusted input. While GitLab released patches on October 12, the fix requires specific Ruby versions, specifically 3.3.13, 3.4.12, or 4.0.9, which were only upstreamed by Ruby developers on October 23.
3Attack Execution Details
The attacker used a newly registered account to submit malicious CI configurations, causing eight worker process crashes. In four instances, the attacker progressed partially through the exploit chain. Furthermore, the attacker downloaded the GitLab container image, indicating they were actively tuning their exploit payload to match the specific build of the target server.
4Upgrade Path Complications
Upgrading to GitLab 19.3.6 on October 22 failed to mitigate the risk because the fix relies on patched Ruby binaries. Since the Alpine instance used standard Ruby rather than GitLab's bundled packages, it remained vulnerable. Users must ensure their container images contain the updated Ruby versions to effectively neutralize this specific security threat.
5Integrity Verification Measures
The team performed rigorous integrity checks on the aports repository and package releases from October 20 to 24. By comparing commits against developer clones and 45 independent builders, they confirmed that no tampering occurred. All releases, including versions 3.21.9 and 3.24.3, remain verified as authentic despite the ongoing GitLab instance compromise.
6Mandatory User Security Actions
As a precaution, all GitLab passwords have been reset. Users must utilize the 'Forgot your password' function upon the service's return. Additionally, the team observed automated login attempts using credentials leaked from other platforms. Users are strongly advised to rotate passwords if they reused their GitLab credentials on any other external web services.
7Container Image Remediation
The alpinelinux/gitlab container image was updated on October 27 to include Ruby 3.3.13. Any image pulled prior to this date is considered vulnerable and must be replaced. Users running GitLab with custom Ruby environments must manually update their Ruby runtime to the specified patched versions to ensure full protection against this exploit.
8Broader System Implications
Because the vulnerability exists in the Ruby regular expression engine, any application processing untrusted regex input remains at risk. Alpine Linux versions 3.21 through edge have already integrated the necessary Ruby patches. Administrators should run 'apk upgrade' immediately to secure their local environments against potential exploitation of this underlying Ruby engine flaw.