Max-severity GitLab flaw exploited against Alpine Linux
Original title: Max-Severity GitLab Vulnerability Exploited Against Alpine Linux
CVE-2026-97229 allows unauthenticated code execution; Alpine rebuilt its instance, and CISA gave agencies three days to patch.
Alpine Linux says a threat actor used CVE-2026-97229 against its GitLab instance on October 20 and 21, one week after GitLab’s October 12 advisory. The CVSS 10 flaw is insufficient regex validation in Ruby’s Onigmo engine and can let an unauthenticated user run code through a crafted CI/CD regular expression. The attack crashed workers and did not show successful code execution, but Alpine rebuilt the instance, is still testing it, and reset passwords. CISA added the bug to the KEV catalog on Thursday.
Unconfirmed: Alpine found no evidence that code ran on the server but says it cannot rule that out.
- GitLab scored CVE-2026-97229 at CVSS 10.
- Four crashes got partway through the exploit and then failed.
- Updating to GitLab 19.3.6 did not fix Alpine’s standard Ruby image.
- Custom Ruby installs need 3.3.13, 3.4.12, 4.0.9 or later.
- CISA ordered federal agencies to patch within three days under BOD 26-04.
Impact: Unauthenticated arbitrary code execution on the GitLab server
| Product | Affected | Fixed in |
|---|---|---|
| GitLab | — | — |
| Ruby | — | 3.3.13, 3.4.12, 4.0.9 or later |
- 1.Patch CVE-2026-97229; federal agencies have three days under BOD 26-04.
- 2.If GitLab uses a separate Ruby, upgrade to 3.3.13, 3.4.12, 4.0.9 or later.
- CVEs
- CVE-2026-97229
- Vendors
- GitLab
- Products
- Ruby
- Victims
- Alpine Linux
- Organizations
- CISA
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-97229 | Unauthenticated RCE in GitLab CE/EE via CI/CD regex | 10.0 | 18% | KEVPoC ×5 | KEV |
From the original article
2 min read at securityweek.com
Tracked as CVE-2026-97229, the bug allows unauthenticated attackers to execute arbitrary code on the server. The post Max-Severity GitLab Vulnerability Exploited Against Alpine Linux appeared first on SecurityWeek.
By Ionut Arghire · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.