Overview
The Alpine Linux project has rebuilt its GitLab development server from scratch and reset all user passwords after attackers attempted to exploit a maximum-severity vulnerability, CVE-2026-97229, against its infrastructure on October 20-21, 2026. Alpine says it found no evidence of tampering with repositories, packages, or releases, but it cannot rule out code execution on the server.
The Vulnerability
| Field | Value |
|---|---|
| CVE ID | CVE-2026-97229 |
| Component | Onigmo regular expression compiler (bundled with Ruby, used by GitLab CI/CD) |
| Type | Integer overflow |
| Severity | Maximum |
| Authentication | Not required |
| GitLab fix released | October 12 |
A specially crafted regular expression in a pipeline configuration can trigger the overflow and potentially let an unauthenticated attacker run code on the server.
What Happened
- On October 20-21, attackers submitted malicious CI configurations that crashed eight worker processes. Four attempts were partially successful, but none appeared to fully succeed.
- The attackers also downloaded Alpine's GitLab container image, which may indicate preparation for a supply-chain attack.
- Alpine first installed GitLab 19.3.4 instead of the patched 19.3.5.
- A later upgrade to 19.3.6 did not close the flaw, because the fix also required a Ruby patch that Alpine's custom container image did not include.
Investigation Results
Alpine found no tampering with repository commits, packages, or releases through October 27. Package signing keys are not stored on the GitLab server, so they could not have been exposed.
However, some logs were missing and outbound connection records were unavailable, so the team could not confirm the server was never fully compromised. Its conclusion: "we cannot rule out code execution."
Data that may have been exposed on the server:
- User details and password hashes
- 2FA secrets
- CI/CD secrets and integration credentials
- Private project content
No compromise of this data has been confirmed.
Recommended Actions
- Reset your Alpine GitLab password, and rotate any credentials or CI/CD secrets stored there.
- Pull the
alpinelinux/gitlab:19.3.6image published October 27, which includes Ruby 3.3.13 and fixes CVE-2026-97229. - Self-hosted GitLab operators: confirm both the GitLab version and the bundled Ruby/Onigmo patch level. Upgrading GitLab alone may not be enough with custom container images.
- Review CI logs for unusual regex-heavy pipeline configurations and worker crashes, and keep outbound connection logging so incidents like this can be scoped.
Key Takeaways
- Patch-level gaps in custom container images can leave a vulnerability open even after the application is upgraded.
- Missing logs turned a likely-unsuccessful attack into a full rebuild. Retain logs and egress records for CI infrastructure.
- Attackers pulling a project's container image is a signal worth treating as possible supply-chain reconnaissance.