A recent serious security flaw in GitLab has been leveraged in an attempted cyber attack on Alpine Linux. This incident occurred just a week after the vulnerability was publicly disclosed.
Understanding the GitLab Vulnerability
The vulnerability, identified as CVE-2026-97229, has been assigned a critical severity score of 10 out of 10. The root of the issue lies in inadequate regular expression validation within Onigmo, which is the regular expression engine for Ruby. GitLab’s advisory from October 12 highlighted that this flaw could permit unauthorized users to execute arbitrary code on a server through a specifically crafted regular expression in a CI/CD configuration.
Details of the Cyber Attack on Alpine Linux
On October 20 and 21, a cybercriminal targeted Alpine Linux’s GitLab instance utilizing the CVE-2026-97229 exploit. Although the attack was unsuccessful, Alpine Linux took precautionary measures by reconstructing the instance entirely. The company has confirmed that its aports repository, packages, and releases from October 21 were not compromised. However, Alpine Linux is still conducting thorough tests before publicizing the updated instance and has reset all passwords due to observed attempts of automated logins using compromised passwords.
Attack Methodology and System Vulnerability
The attackers utilized a newly created account to send crafted CI configurations, which resulted in the worker process crashing. The exploit attempt managed to partially succeed in four instances but failed to complete. It was noted that the attackers downloaded Alpine Linux’s GitLab container image, possibly to fine-tune the exploit to match the specific build. Although there is no confirmed evidence of executed code on the server, complete certainty has not been achieved.
The core issue stems from a vulnerability in Ruby, not GitLab itself. Since Alpine Linux’s image utilizes standard Ruby, updating GitLab to version 19.3.6 did not resolve the vulnerability. Alpine Linux advises those running GitLab with their own Ruby setup to upgrade to Ruby versions 3.3.13, 3.4.12, or 4.0.9 or later to mitigate the risk.
Urgent Advisory from Cybersecurity Authorities
In response to this security threat, the US Cybersecurity and Infrastructure Security Agency (CISA) has included CVE-2026-97229 in its Known Exploited Vulnerabilities catalog. Federal agencies have been urged to apply patches within three days, as required by Binding Operational Directive 26-04. This event underscores the critical need for timely updates and vigilance in cybersecurity practices to prevent exploitation of known vulnerabilities.
Related discussions include vulnerabilities in other systems, such as TeamViewer and Adobe, indicating a broader context of ongoing cybersecurity challenges.
