Max-Severity GitLab Vulnerability Exploited Against Alpine Linux

Hi, what are you looking for?

Tracked as CVE-2026-97229, the bug allows unauthenticated attackers to execute arbitrary code on the server.

By

Flipboard

Reddit

Whatsapp

Whatsapp

Email

A recent code execution vulnerability in GitLab was exploited one week after disclosure in a failed attack against Alpine Linux’s instance.Tracked as CVE-2026-97229 (CVSS score of 10/10), the flaw stems from insufficient regular expression validation in Onigmo, Ruby’s regular expression engine.The bug “could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration,” GitLab noted in an October 12advisory.According to Alpine Linux, a threat actor targeted its GitLab instance with a CVE-2026-97229 exploit on October 20 and 21. The attack failed, but the Linux distribution rebuilt the instance from scratch.“Our checks show that the aports repository, packages, and the October 21 releases were not tampered with,”Alpine Linux notes.It is still testing the GitLab instance before public release, and has reset all passwords, warning of observed automated login attempts using passwords compromised in other leaks.Advertisement. Scroll to continue reading.As part of the October 20-21 attack, the hackers used a newly registered account to send crafted CI configurations to Alpine Linux’s GitLab instance, crashing the worker process.“In 4 of those crashes, the attacker got partway through the exploit and failed at the next step. The attacker also downloaded our GitLab container image, which suggests they were tuning the exploit to our exact build. We have found no evidence that the attacker ran code on the server, but we cannot rule it out,” Alpine Linux says.Because the underlying vulnerability resides in Ruby, not in GitLab, and the Linux distribution’s image runs standard Ruby, the vulnerability was not patched after updating to GitLab 19.3.6.“If you run GitLab with your own Ruby (from source or in your own container image) rather than GitLab’s packages, upgrading GitLab is not enough: you also need Ruby 3.3.13, 3.4.12, 4.0.9 or later,” Alpine Linux notes.On Thursday, the US cybersecurity agency CISA added CVE-2026-97229 to its Known Exploited Vulnerabilities (KEV) catalog, urging federal agencies to patch it within three days, as mandated by BOD 26-04.Related:TeamViewer Flaw Could Let Malicious Hosts Take Over Support Technicians’ MachinesRelated:Adobe, Veeam, Juniper Networks Patch Critical VulnerabilitiesRelated:Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-DayRelated:Hackers Start Probing Fresh Oracle EBS Vulnerability

Tracked as CVE-2026-97229 (CVSS score of 10/10), the flaw stems from insufficient regular expression validation in Onigmo, Ruby’s regular expression engine.The bug “could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration,” GitLab noted in an October 12advisory.According to Alpine Linux, a threat actor targeted its GitLab instance with a CVE-2026-97229 exploit on October 20 and 21. The attack failed, but the Linux distribution rebuilt the instance from scratch.“Our checks show that the aports repository, packages, and the October 21 releases were not tampered with,”Alpine Linux notes.It is still testing the GitLab instance before public release, and has reset all passwords, warning of observed automated login attempts using passwords compromised in other leaks.Advertisement. Scroll to continue reading.As part of the October 20-21 attack, the hackers used a newly registered account to send crafted CI configurations to Alpine Linux’s GitLab instance, crashing the worker process.“In 4 of those crashes, the attacker got partway through the exploit and failed at the next step. The attacker also downloaded our GitLab container image, which suggests they were tuning the exploit to our exact build. We have found no evidence that the attacker ran code on the server, but we cannot rule it out,” Alpine Linux says.Because the underlying vulnerability resides in Ruby, not in GitLab, and the Linux distribution’s image runs standard Ruby, the vulnerability was not patched after updating to GitLab 19.3.6.“If you run GitLab with your own Ruby (from source or in your own container image) rather than GitLab’s packages, upgrading GitLab is not enough: you also need Ruby 3.3.13, 3.4.12, 4.0.9 or later,” Alpine Linux notes.On Thursday, the US cybersecurity agency CISA added CVE-2026-97229 to its Known Exploited Vulnerabilities (KEV) catalog, urging federal agencies to patch it within three days, as mandated by BOD 26-04.Related:TeamViewer Flaw Could Let Malicious Hosts Take Over Support Technicians’ MachinesRelated:Adobe, Veeam, Juniper Networks Patch Critical VulnerabilitiesRelated:Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-DayRelated:Hackers Start Probing Fresh Oracle EBS Vulnerability

The bug “could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration,” GitLab noted in an October 12advisory.According to Alpine Linux, a threat actor targeted its GitLab instance with a CVE-2026-97229 exploit on October 20 and 21. The attack failed, but the Linux distribution rebuilt the instance from scratch.“Our checks show that the aports repository, packages, and the October 21 releases were not tampered with,”Alpine Linux notes.It is still testing the GitLab instance before public release, and has reset all passwords, warning of observed automated login attempts using passwords compromised in other leaks.Advertisement. Scroll to continue reading.As part of the October 20-21 attack, the hackers used a newly registered account to send crafted CI configurations to Alpine Linux’s GitLab instance, crashing the worker process.“In 4 of those crashes, the attacker got partway through the exploit and failed at the next step. The attacker also downloaded our GitLab container image, which suggests they were tuning the exploit to our exact build. We have found no evidence that the attacker ran code on the server, but we cannot rule it out,” Alpine Linux says.Because the underlying vulnerability resides in Ruby, not in GitLab, and the Linux distribution’s image runs standard Ruby, the vulnerability was not patched after updating to GitLab 19.3.6.“If you run GitLab with your own Ruby (from source or in your own container image) rather than GitLab’s packages, upgrading GitLab is not enough: you also need Ruby 3.3.13, 3.4.12, 4.0.9 or later,” Alpine Linux notes.On Thursday, the US cybersecurity agency CISA added CVE-2026-97229 to its Known Exploited Vulnerabilities (KEV) catalog, urging federal agencies to patch it within three days, as mandated by BOD 26-04.Related:TeamViewer Flaw Could Let Malicious Hosts Take Over Support Technicians’ MachinesRelated:Adobe, Veeam, Juniper Networks Patch Critical VulnerabilitiesRelated:Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-DayRelated:Hackers Start Probing Fresh Oracle EBS Vulnerability

According to Alpine Linux, a threat actor targeted its GitLab instance with a CVE-2026-97229 exploit on October 20 and 21. The attack failed, but the Linux distribution rebuilt the instance from scratch.“Our checks show that the aports repository, packages, and the October 21 releases were not tampered with,”Alpine Linux notes.It is still testing the GitLab instance before public release, and has reset all passwords, warning of observed automated login attempts using passwords compromised in other leaks.Advertisement. Scroll to continue reading.As part of the October 20-21 attack, the hackers used a newly registered account to send crafted CI configurations to Alpine Linux’s GitLab instance, crashing the worker process.“In 4 of those crashes, the attacker got partway through the exploit and failed at the next step. The attacker also downloaded our GitLab container image, which suggests they were tuning the exploit to our exact build. We have found no evidence that the attacker ran code on the server, but we cannot rule it out,” Alpine Linux says.Because the underlying vulnerability resides in Ruby, not in GitLab, and the Linux distribution’s image runs standard Ruby, the vulnerability was not patched after updating to GitLab 19.3.6.“If you run GitLab with your own Ruby (from source or in your own container image) rather than GitLab’s packages, upgrading GitLab is not enough: you also need Ruby 3.3.13, 3.4.12, 4.0.9 or later,” Alpine Linux notes.On Thursday, the US cybersecurity agency CISA added CVE-2026-97229 to its Known Exploited Vulnerabilities (KEV) catalog, urging federal agencies to patch it within three days, as mandated by BOD 26-04.Related:TeamViewer Flaw Could Let Malicious Hosts Take Over Support Technicians’ MachinesRelated:Adobe, Veeam, Juniper Networks Patch Critical VulnerabilitiesRelated:Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-DayRelated:Hackers Start Probing Fresh Oracle EBS Vulnerability

“Our checks show that the aports repository, packages, and the October 21 releases were not tampered with,”Alpine Linux notes.It is still testing the GitLab instance before public release, and has reset all passwords, warning of observed automated login attempts using passwords compromised in other leaks.Advertisement. Scroll to continue reading.As part of the October 20-21 attack, the hackers used a newly registered account to send crafted CI configurations to Alpine Linux’s GitLab instance, crashing the worker process.“In 4 of those crashes, the attacker got partway through the exploit and failed at the next step. The attacker also downloaded our GitLab container image, which suggests they were tuning the exploit to our exact build. We have found no evidence that the attacker ran code on the server, but we cannot rule it out,” Alpine Linux says.Because the underlying vulnerability resides in Ruby, not in GitLab, and the Linux distribution’s image runs standard Ruby, the vulnerability was not patched after updating to GitLab 19.3.6.“If you run GitLab with your own Ruby (from source or in your own container image) rather than GitLab’s packages, upgrading GitLab is not enough: you also need Ruby 3.3.13, 3.4.12, 4.0.9 or later,” Alpine Linux notes.On Thursday, the US cybersecurity agency CISA added CVE-2026-97229 to its Known Exploited Vulnerabilities (KEV) catalog, urging federal agencies to patch it within three days, as mandated by BOD 26-04.Related:TeamViewer Flaw Could Let Malicious Hosts Take Over Support Technicians’ MachinesRelated:Adobe, Veeam, Juniper Networks Patch Critical VulnerabilitiesRelated:Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-DayRelated:Hackers Start Probing Fresh Oracle EBS Vulnerability

It is still testing the GitLab instance before public release, and has reset all passwords, warning of observed automated login attempts using passwords compromised in other leaks.Advertisement. Scroll to continue reading.As part of the October 20-21 attack, the hackers used a newly registered account to send crafted CI configurations to Alpine Linux’s GitLab instance, crashing the worker process.“In 4 of those crashes, the attacker got partway through the exploit and failed at the next step. The attacker also downloaded our GitLab container image, which suggests they were tuning the exploit to our exact build. We have found no evidence that the attacker ran code on the server, but we cannot rule it out,” Alpine Linux says.Because the underlying vulnerability resides in Ruby, not in GitLab, and the Linux distribution’s image runs standard Ruby, the vulnerability was not patched after updating to GitLab 19.3.6.“If you run GitLab with your own Ruby (from source or in your own container image) rather than GitLab’s packages, upgrading GitLab is not enough: you also need Ruby 3.3.13, 3.4.12, 4.0.9 or later,” Alpine Linux notes.On Thursday, the US cybersecurity agency CISA added CVE-2026-97229 to its Known Exploited Vulnerabilities (KEV) catalog, urging federal agencies to patch it within three days, as mandated by BOD 26-04.Related:TeamViewer Flaw Could Let Malicious Hosts Take Over Support Technicians’ MachinesRelated:Adobe, Veeam, Juniper Networks Patch Critical VulnerabilitiesRelated:Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-DayRelated:Hackers Start Probing Fresh Oracle EBS Vulnerability

As part of the October 20-21 attack, the hackers used a newly registered account to send crafted CI configurations to Alpine Linux’s GitLab instance, crashing the worker process.“In 4 of those crashes, the attacker got partway through the exploit and failed at the next step. The attacker also downloaded our GitLab container image, which suggests they were tuning the exploit to our exact build. We have found no evidence that the attacker ran code on the server, but we cannot rule it out,” Alpine Linux says.Because the underlying vulnerability resides in Ruby, not in GitLab, and the Linux distribution’s image runs standard Ruby, the vulnerability was not patched after updating to GitLab 19.3.6.“If you run GitLab with your own Ruby (from source or in your own container image) rather than GitLab’s packages, upgrading GitLab is not enough: you also need Ruby 3.3.13, 3.4.12, 4.0.9 or later,” Alpine Linux notes.On Thursday, the US cybersecurity agency CISA added CVE-2026-97229 to its Known Exploited Vulnerabilities (KEV) catalog, urging federal agencies to patch it within three days, as mandated by BOD 26-04.Related:TeamViewer Flaw Could Let Malicious Hosts Take Over Support Technicians’ MachinesRelated:Adobe, Veeam, Juniper Networks Patch Critical VulnerabilitiesRelated:Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-DayRelated:Hackers Start Probing Fresh Oracle EBS Vulnerability

“In 4 of those crashes, the attacker got partway through the exploit and failed at the next step. The attacker also downloaded our GitLab container image, which suggests they were tuning the exploit to our exact build. We have found no evidence that the attacker ran code on the server, but we cannot rule it out,” Alpine Linux says.Because the underlying vulnerability resides in Ruby, not in GitLab, and the Linux distribution’s image runs standard Ruby, the vulnerability was not patched after updating to GitLab 19.3.6.“If you run GitLab with your own Ruby (from source or in your own container image) rather than GitLab’s packages, upgrading GitLab is not enough: you also need Ruby 3.3.13, 3.4.12, 4.0.9 or later,” Alpine Linux notes.On Thursday, the US cybersecurity agency CISA added CVE-2026-97229 to its Known Exploited Vulnerabilities (KEV) catalog, urging federal agencies to patch it within three days, as mandated by BOD 26-04.Related:TeamViewer Flaw Could Let Malicious Hosts Take Over Support Technicians’ MachinesRelated:Adobe, Veeam, Juniper Networks Patch Critical VulnerabilitiesRelated:Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-DayRelated:Hackers Start Probing Fresh Oracle EBS Vulnerability

Because the underlying vulnerability resides in Ruby, not in GitLab, and the Linux distribution’s image runs standard Ruby, the vulnerability was not patched after updating to GitLab 19.3.6.“If you run GitLab with your own Ruby (from source or in your own container image) rather than GitLab’s packages, upgrading GitLab is not enough: you also need Ruby 3.3.13, 3.4.12, 4.0.9 or later,” Alpine Linux notes.On Thursday, the US cybersecurity agency CISA added CVE-2026-97229 to its Known Exploited Vulnerabilities (KEV) catalog, urging federal agencies to patch it within three days, as mandated by BOD 26-04.Related:TeamViewer Flaw Could Let Malicious Hosts Take Over Support Technicians’ MachinesRelated:Adobe, Veeam, Juniper Networks Patch Critical VulnerabilitiesRelated:Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-DayRelated:Hackers Start Probing Fresh Oracle EBS Vulnerability

“If you run GitLab with your own Ruby (from source or in your own container image) rather than GitLab’s packages, upgrading GitLab is not enough: you also need Ruby 3.3.13, 3.4.12, 4.0.9 or later,” Alpine Linux notes.On Thursday, the US cybersecurity agency CISA added CVE-2026-97229 to its Known Exploited Vulnerabilities (KEV) catalog, urging federal agencies to patch it within three days, as mandated by BOD 26-04.Related:TeamViewer Flaw Could Let Malicious Hosts Take Over Support Technicians’ MachinesRelated:Adobe, Veeam, Juniper Networks Patch Critical VulnerabilitiesRelated:Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-DayRelated:Hackers Start Probing Fresh Oracle EBS Vulnerability

On Thursday, the US cybersecurity agency CISA added CVE-2026-97229 to its Known Exploited Vulnerabilities (KEV) catalog, urging federal agencies to patch it within three days, as mandated by BOD 26-04.Related:TeamViewer Flaw Could Let Malicious Hosts Take Over Support Technicians’ MachinesRelated:Adobe, Veeam, Juniper Networks Patch Critical VulnerabilitiesRelated:Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-DayRelated:Hackers Start Probing Fresh Oracle EBS Vulnerability

Related:TeamViewer Flaw Could Let Malicious Hosts Take Over Support Technicians’ MachinesRelated:Adobe, Veeam, Juniper Networks Patch Critical VulnerabilitiesRelated:Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-DayRelated:Hackers Start Probing Fresh Oracle EBS Vulnerability

Related:Adobe, Veeam, Juniper Networks Patch Critical VulnerabilitiesRelated:Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-DayRelated:Hackers Start Probing Fresh Oracle EBS Vulnerability

Related:Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-DayRelated:Hackers Start Probing Fresh Oracle EBS Vulnerability

Related:Hackers Start Probing Fresh Oracle EBS Vulnerability

Ionut Arghire is an international correspondent for SecurityWeek.

Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Close the security gaps between pentests. Join this session to explore agentic pentesting and gain a practical framework for continuous exposure validation in your CTEM program.

Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.

Barracuda has appointed Dan Fletcher as CFO.

Artemis Security has appointed Arun Singh as CGO.

General Paul M. Nakasone has joined Armadin’s Board of Directors.

As organizations eliminate passwords, attackers will adapt. Instead of attacking the authenticator directly, they will look for opportunities around it.(Torsten George)

Risk managers are trained to spot weak signals, plan for disruption and make hard decisions under uncertainty. But the discipline looks different when the risk is not a system or an enterprise, but you.(Steve Durbin)

The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies.(Sravish Sridhar)

Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.(Tod Beardsley)

Where your developers sit on the AI adoption scale has a real impact on how you are addressing security risk.(Matias Madou)

Flipboard

Reddit

Whatsapp

Whatsapp

Email

Got a confidential news tip? We want to hear from you.

Reach a large audience of enterprise cybersecurity professionals

Subscribe to the SecurityWeek Daily Briefing and get the latest content delivered to your inbox.

Copyright © 2026 SecurityWeek ®, a Wired Business Media Publication. All Rights Reserved.