Alpine Linux rebuilds its GitLab after an attempted exploitation

According to a Bleeping Computer article published on 1 November 2026, based on the Alpine Linux team’s own write-up, attackers tried to exploit CVE-2026-97229 on the project’s GitLab instance on 20 and 21 October. The team has since rebuilt the server from scratch and reset every password. For now, this account rests on a single press source, so take what follows with the appropriate pinch of salt.

A critical flaw in the regex engine

CVE-2026-97229 carries the highest severity rating available. It is an integer overflow in Onigmo, the regular expression compiler that ships with Ruby and is used by GitLab’s CI/CD machinery. Under certain conditions, an unauthenticated attacker could run arbitrary code on the server by slipping a crafted regular expression into a pipeline configuration. Regexes already give most developers a headache. This one could have given a stranger a seat at your server’s command line. GitLab published the advisory and fixes on 12 October.

On 20 and 21 October, malicious CI configurations targeting the flaw were submitted to Alpine’s instance. They reportedly caused eight worker process crashes, four of which partly succeeded, but no attempt seems to have made it all the way. The attackers also downloaded Alpine’s GitLab container image. According to the source, that suggests they were preparing a supply chain attack.

Updated twice, still vulnerable

The whole incident comes down to the update timeline. Alpine first installed GitLab 19.3.4 instead of the fixed release, 19.3.5. The later move to 19.3.6 didn’t do the job either: the fix required a patched Ruby, which GitLab ships in its official packages but which Alpine’s home-built container image didn’t include.

So the GitLab version number described a patched instance, while the component that was actually vulnerable was nothing of the sort. It’s like reading the label on the tin and never checking what’s inside. Any team that rebuilds its own images from official releases risks the same gap: the fix doesn’t always live in the component whose version you’re watching.

Why a distribution is a prime target

Alpine Linux is a lightweight system and a hugely popular base for Docker images. Its GitLab hosts the development repositories, code reviews and CI jobs, including the aports build recipes used to produce the distribution’s packages. Tampering with that environment could ripple out to downstream software, far beyond the project itself. If someone poisons the well upstream, everyone who drinks downstream gets a sip.

What’s established, and what isn’t

The Alpine team says it found no tampering with commits, packages or published releases up to 27 October. Signing keys are not stored on the GitLab server, so they could not have been exposed. However, because some logs are missing and outbound connections were not recorded, the team cannot rule out code execution. That is why it chose to rebuild the instance rather than repair it.

Had the exploitation succeeded, several kinds of data could have been exposed: user information, password hashes, two-factor authentication secrets, CI/CD secrets, integration credentials and the contents of private projects. None of these compromises has been confirmed.

Alpine is asking anyone with an account on this GitLab to reset their password. Administrators who use the alpinelinux/gitlab image should pull version 19.3.6, released on 27 October: it bundles Ruby 3.3.13 and fixes CVE-2026-97229.

Alpine hit “update” twice. The fix, though, lived in a Ruby that neither update brought along, and that gap is exactly where the attackers tried to squeeze through.