An attempt to exploit a severe vulnerability in GitLab was made on the Alpine Linux project’s GitLab server shortly after GitLab had issued a patch. This incident, reported by Alpine Linux on October 28, involved a flaw labeled CVE-2026-97229, which carries a critical 10.0 CVSS score. This vulnerability allowed potential code execution via a manipulated regular expression in a CI configuration. Although Alpine found no direct evidence of a successful exploitation, they opted for caution by rebuilding the server and resetting all user passwords.
Details of the Security Flaw
The vulnerability stems from a bug in Ruby’s regular expression engine, Onigmo, which GitLab utilizes in its CI configurations. While GitLab released patches on October 12 to address this issue, Alpine’s GitLab image, which employed standard Ruby, required a specific update to Ruby itself. Consequently, Alpine’s upgrade to GitLab version 19.3.6 on October 22 did not immediately resolve the issue.
Administrators using custom Ruby builds must ensure they upgrade to Ruby versions 3.3.13, 3.4.12, 4.0.9, or newer to mitigate the vulnerability. Alpine’s alpinelinux/gitlab image users are advised to re-pull version 19.3.6 to ensure security.
Incident Timeline and Response
The attack began when a newly registered account probed the server on October 20, following Alpine’s upgrade to GitLab version 19.3.4, which lacked the necessary patch. The attacker used crafted CI configurations, crashing GitLab worker processes multiple times. Despite some progress in the exploit, the attacker failed to fully execute the code.
Alpine blocked the malicious account on October 23. After further attempts on October 25 and 26 failed, Alpine discovered their server remained vulnerable post-upgrade. Subsequently, GitLab access was restricted to developers and build servers, and a rebuild was completed by October 28 using a secure Ruby version.
Security Measures and Recommendations
Alpine’s audit found no conclusive evidence of code execution, but missing logs and potential stealthy attack methods meant treating the server as compromised was prudent. Sensitive data potentially at risk included user information, password hashes, and CI/CD credentials. While Alpine reset passwords and replaced secret keys, further measures like replacing runner tokens and access credentials were not disclosed.
GitLab administrators are advised to ensure their servers are running patched versions of both GitLab and Ruby. For those unable to upgrade immediately, limiting anonymous access and controlling project creation rights are interim measures suggested by security experts. GitLab has also provided detection rules to identify attempts of exploitation.
Alpine Linux users must reset their passwords upon re-opening of gitlab.alpinelinux.org and ensure updated images and packages are in use. This incident highlights the importance of timely updates and comprehensive security practices to safeguard against potential exploits.
