Science & Tech · Cybersecurity · 1 hr ago
Alpine Linux Rebuilds GitLab Server After Failed Exploit Attempt
An attacker targeted Alpine Linux’s GitLab server on October 20 and 21 using a flaw that can let someone run code on a server.
The flaw, tracked as CVE-2026-97229, was rated 10 out of 10 in severity and involves Ruby, the programming language used by GitLab.
Alpine’s server was still vulnerable because its installation used standard Ruby, which was not fixed by upgrading GitLab alone.
The attempted attack crashed worker processes, but Alpine found no evidence that the attacker ran code and said it could not rule that out.
Alpine rebuilt the server and reset passwords as a precaution, and is testing it before reopening it to the public.
It says checks found no tampering with its package repository or the October 21 releases, and its signing keys were not stored on the server.
CISA added the flaw to its exploited-vulnerabilities list and told US federal agencies to patch it within three days; servers using their own Ruby also need an updated Ruby version.
Alpine Linux rebuilt its GitLab server after an attacker tried to exploit a critical vulnerability on 20 and 21 October.
The flaw, CVE-2026-97229, has a CVSS score of 10 out of 10 and could allow code execution through a crafted CI configuration.
Alpine found no evidence that the attacker ran code, but said it could not rule that out.
The attack crashed GitLab worker processes, and the attacker downloaded Alpine’s GitLab container image.
Alpine reset account passwords, replaced GitLab’s secret keys and is testing the rebuilt server before reopening it to the public.
- Who
- An attacker targeted Alpine Linux’s GitLab server.
- What
- The attacker tried to exploit CVE-2026-97229. Alpine found no evidence the attack succeeded, but could not rule out code execution and rebuilt the server.
- When
- The attack took place on 20 and 21 October 2026.
- Where
- Alpine Linux’s GitLab server, gitlab.alpinelinux.org.
- Why
- The flaw could allow code execution through a specially crafted regular expression in a CI configuration. The attacker’s motive is not stated.
This story does not have two clearly opposing sides.
Alpine upgraded its server to GitLab 19.3.4 instead of 19.3.5, leaving it without the 12 October fix.
A newly registered account sent crafted CI configurations to the server, crashing worker processes.
Alpine upgraded GitLab to 19.3.6, but the server remained vulnerable because its image used standard Ruby.
Alpine blocked the attacker’s account.
The attacker tried to regain access, but the attempts failed.
Alpine closed the server to the public, rebuilt it from scratch and finished the rebuild.
- Vulnerability
- CVE-2026-97229; CVSS score 10 out of 10
- Affected server
- gitlab.alpinelinux.org
- Attack dates
- 20 and 21 October 2026
- Worker crashes
- 8
- Rebuild completed
- 28 October 2026
- Fixed Ruby versions
- 3.3.13, 3.4.12, 4.0.9 or later
2 sources
What people are saying
We have found no evidence that the attacker ran code on the server, but we cannot rule it out
A successful exploit would leave no crash and no trace in the web logs
suggests they were tuning the exploit to our exact build
If you run GitLab with your own Ruby (from source or in your own container image) rather than GitLab’s packages, upgrading GitLab is not enough: you also need Ruby 3.3.13, 3.4.12, 4.0.9 or later