GitLab Security Incident: Attempted Exploitation of CVE-2026-97229

Alpine Linux’s GitLab instance was targeted on October 20-21, 2026, through CVE-2026-97229, a critical flaw in Ruby’s Onigmo regular-expression engine that could be triggered by crafted CI configuration. The attacker used a newly created account to crash GitLab workers eight times; in four cases, the exploit advanced partway before failing. Downloading Alpine’s GitLab container image suggested the attacker was adapting the exploit to that build. Alpine upgraded GitLab on October 22, but the upgrade did not include the necessary Ruby patch: the vulnerable image used standard Ruby rather than GitLab’s patched package. After finding the flaw still present, Alpine closed the service and rebuilt it from scratch, replacing its secret keys and resetting all user passwords.

Alpine found no evidence of successful code execution, data theft, or tampering with its repositories, packages, or October 21 releases. Checks against records held outside GitLab verified the relevant commits and builds, and package-signing keys were never stored on the server. However, missing logs and the possibility that a successful exploit would leave no trace prevent Alpine from ruling out compromise. If exploitation succeeded, user details, password hashes, two-factor secrets, CI variables, tokens, credentials, and private project data could have been exposed. Users must choose new GitLab passwords when service resumes and change any reused passwords elsewhere. Alpine also plans faster security patching, longer and broader logging, and independently verifiable signed release tags.