TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Alpine Linux says an attacker made repeated attempts to exploit CVE-2026-97229 against its GitLab instance on Oct. 20 and 21, causing worker crashes and getting partway through the exploit in four attempts. The project found no evidence of server access or tampering with repositories, packages or releases, but says missing logs mean it cannot rule out a successful intrusion; it rebuilt GitLab and reset all passwords.
Alpine Linux said on October 28 that an attacker tried to exploit CVE-2026-97229 against its GitLab instance on October 20 and 21, prompting the project to rebuild the server and reset all passwords. Alpine found no evidence the attack succeeded, but says it cannot rule out code execution because some relevant logs and system data are no longer available.
According to Alpine’s incident report, a newly registered account submitted crafted CI configurations to a GitLab instance running version 19.3.4, which had not received the fix released on October 12. The submissions crashed GitLab worker processes eight times. In four crashes, Alpine said, the attacker progressed partway through the exploit but failed at a later step. The account also downloaded Alpine’s GitLab container image, which the project said suggested the attacker was adapting the attempt to its specific build.
Alpine said its investigation found no unexpected files, keys, hooks or processes, and timing checks did not show delays associated with code execution. It also found no private data returned through the web or API requests it could review. However, it warned that a successful exploit might leave no crash or web-log trace. Some background-job logs and the old container filesystem were gone, and the project had no records of outbound network connections.
The project upgraded to GitLab 19.3.6 on October 22, but later found that the instance remained vulnerable. Alpine explained that the fix involved a patch to the Ruby runtime bundled in GitLab’s official packages, rather than a change in GitLab’s own code. Its container image did not include that patch. Alpine closed GitLab to most users on October 27, began a rebuild, replaced the instance’s secret keys and completed the rebuild the next day. All account passwords were reset.
What the Exploit Could Expose
The uncertainty matters because successful exploitation could have exposed information and credentials associated with Alpine’s GitLab users. The project listed possible exposure of email addresses, names and IP addresses, password hashes, two-factor authentication secrets, CI/CD variables, runner tokens, integration credentials and personal access tokens. Private repositories and confidential issues or merge requests could also have been at risk.
Alpine’s report does not establish that any of these materials were accessed. Its decision to rebuild reflects the limits of what could be verified after the incident, not a finding that data was stolen. For users, the clearest immediate action is to follow Alpine’s password-reset instructions when GitLab reopens and change any password reused on another service. For operators, the incident underscores that upgrading GitLab alone may not address a flaw in a bundled or separately supplied runtime.
The project said its package-signing keys were not stored on the GitLab server, and that it found no tampering in Alpine’s repositories, packages or releases. That distinction is important: the reported risk concerns the GitLab instance and information potentially held there, while Alpine’s checks did not find evidence that its software distribution was altered.
Products Worth Considering
Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo
Logitech MX Mechanical Full-Size Wireless Mechanical Keyboard, Tactile Quiet Switches, Backlit Keys, Bluetooth, USB-C, Multi-Device, Graphit
Trezor Safe 5 Crypto Hardware Wallet with Color Touchscreen, Black Graphite
As an affiliate, we earn on qualifying purchases.
The Ruby Patch Behind the Incident
Alpine’s report describes CVE-2026-97229 as a critical vulnerability with a CVSS score of 10.0 involving GitLab’s evaluation of regular expressions in CI configuration. The underlying issue is in Onigmo, the regular-expression engine built into Ruby. GitLab published fixed releases on October 12, while upstream Ruby shipped patched releases on October 23: Ruby 3.3.13, 3.4.12 and 4.0.9.
The timing and packaging details shaped Alpine’s response. The project said it mistakenly upgraded to GitLab 19.3.4 after the vulnerability was published on October 13, rather than to 19.3.5, which included the fix. Its October 22 move to GitLab 19.3.6 still did not resolve the issue because the container used standard Ruby instead of GitLab’s patched Ruby build. Alpine said its alpinelinux/gitlab:19.3.6 image published October 27 contains Ruby 3.3.13; earlier pulls of that tag, as well as older tags, remain vulnerable.
Alpine separately checked whether the incident affected software published through its infrastructure. It said the October 21 stable releases—versions 3.21.9, 3.22.7, 3.23.7 and 3.24.3—and packages built from October 20 to 24 were verified against records outside GitLab. The project said it compared repository commits with a developer’s clone and records from all 45 builders. It reported no evidence of altered packages or releases.
Evidence Gaps and User Exposure
Alpine has not established whether the attacker executed code on the server, accessed user data or extracted credentials. It says records needed to settle those questions are incomplete: background-job logs and the old container filesystem are missing, and neither Alpine nor its hosting provider recorded outbound network connections. The report says a successful exploit might not have produced a crash or a web-log entry, limiting what can be inferred from the surviving evidence.
The project’s review found no unexpected server artifacts and no private information returned in the web or API requests it could inspect. Those findings are not proof that access did not occur. Alpine has not reported evidence that specific accounts or repositories were accessed, and it has not identified a confirmed list of affected users or data. Its stated list of potentially exposed material describes what could have been available if the exploit succeeded, not confirmed theft.
Reopening After Security Testing
Alpine said GitLab is being tested before it is opened to the public again. It said it would publish instructions for users when service resumes; account holders will need to set new passwords through the sign-in page’s “Forgot your password?” process. The project also advised users who reused their GitLab password elsewhere to change it on those other services, citing automated login attempts using passwords leaked from other sites.
Until GitLab reopens, Alpine said its package mirrors, cgit, mailing lists and IRC remain available. The report does not give a reopening date or provide further findings that would resolve whether the attacker achieved code execution. Alpine invited questions and concerns through infra@alpinelinux.org.
Key Questions
Did the attacker successfully breach Alpine’s GitLab server?
Alpine said it found no evidence that code ran on the server, but it cannot rule out success because some logs and the old container filesystem were unavailable.
Were Alpine Linux packages or releases altered?
Alpine said it found no sign of tampering. It checked repository commits and builds against records outside GitLab, and said the October 21 releases and packages built from October 20 to 24 matched verified source records.
What should Alpine GitLab users do?
When GitLab reopens, users will need to set a new password using the “Forgot your password?” link. Alpine also advises changing any password reused on another service.
Does upgrading GitLab fix CVE-2026-97229 in every setup?
Not necessarily, according to Alpine. The fix depends on the Ruby runtime as well as the GitLab version. Administrators using their own Ruby or custom container images should check that Ruby includes the patch; Alpine identified Ruby 3.3.13, 3.4.12 and 4.0.9 as fixed releases.
When will Alpine’s GitLab reopen?
Alpine said the rebuilt instance was undergoing testing before public access resumes, but its October 28 report did not give a reopening date.
Source: alpinelinux.org
