Attacker probed Alpine GitLab via CVSS 10 flaw (CVE-2026-97229)
Original title: Attacker Tried to Exploit Alpine Linux’s GitLab via CVSS 10.0 Flaw Its Ruby Left Open
Alpine rebuilt gitlab.alpinelinux.org and reset passwords after probes; GitLab upgrades alone miss installs on stock Ruby.
Alpine Linux said an attacker tried to exploit CVE-2026-97229, a CVSS 10.0 GitLab flaw in Ruby's Onigmo engine, on gitlab.alpinelinux.org about a week after GitLab's fix. Crafted CI configurations crashed workers; Alpine found no proof of code execution but rebuilt the server because logs needed to confirm success are gone. Official GitLab packages patch bundled Ruby, but Alpine's image and other self-built installs stay vulnerable until Ruby itself is updated. Rapid7 published a lab proof of concept on October 13.
Unconfirmed: Alpine cannot confirm whether the exploit ran; crash-free success would leave no web-log trace, and some attack-day logs are gone.
- The server was left on GitLab 19.3.4 after an October 13 upgrade mistake.
- Probes on October 20–21 crashed workers eight times; the account was blocked October 23.
- Fixed Ruby versions named are 3.3.13, 3.4.12, 4.0.9 or later.
- Users of alpinelinux/gitlab must pull 19.3.6 again.
- Package-signing keys were never on the GitLab server, Alpine said.
Impact: possible unauthenticated code execution on the GitLab server
| Product | Affected | Fixed in |
|---|---|---|
| GitLab | unpatched servers; Alpine was on 19.3.4, then 19.3.6 with stock Ruby | GitLab packages and official images with patched Ruby; Alpine image 19.3.6 re-pulled |
| Ruby | Ruby before the October 22–23 fixes; 3.2 is end of life with no fix | 3.3.13, 3.4.12, 4.0.9 or later |
- 1.Update self-compiled or separately installed Ruby to 3.3.13, 3.4.12, 4.0.9 or later.
- 2.Re-pull Alpine's alpinelinux/gitlab image tagged 19.3.6.
- 3.Prefer GitLab's official Linux packages or container images, which ship patched Ruby.
- CVEs
- CVE-2026-97229
- Vendors
- GitLab
- Products
- Ruby
- Victims
- Alpine Linux
- Organizations
- Rapid7
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-97229 | Unauthenticated RCE in GitLab CE/EE via CI/CD regex | 10.0 | 18% | KEVPoC ×5 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | gitlab.alpinelinux.org | inelinux/gitlab image need to pull 19.3.6 again. The server gitlab.alpinelinux.org hosts aports, the repository from which Alpine's packages a |
From the original article
7 min read at thehackernews.com
An attacker tried to exploit a critical GitLab vulnerability on the Alpine Linux project's own GitLab server a week after GitLab released a fix, Alpine Linux said on 28 October. The flaw, CVE-2026-97229 (CVSS score: 10. 0), can let an attacker run code on a GitLab server through a crafted regular expression in a CI configuration.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.