Alpine Linux has rebuilt its GitLab instance from scratch and reset all passwords after hackers attempted to exploit a critical remote code execution vulnerability in the development infrastructure. The attackers targeted CVE-2026-97229, a maximum-severity flaw in GitLab's regular expression compiler, between October 20 and 21, causing multiple process crashes. While the Alpine team found no evidence that attackers successfully executed code or tampered with software packages, missing logs and a lack of outbound connection records mean a compromise cannot be ruled out.
The vulnerability, CVE-2026-97229, is an integer overflow in GitLab's CI/CD regular expression compiler Onigmo, bundled in Ruby, that could allow unauthenticated attackers to execute arbitrary code. GitLab disclosed the flaw and released fixes on October 12. Alpine initially installed GitLab 19.3.4 instead of the patched version, 19.3.5. A later upgrade to 19.3.6 also failed to close the flaw because the fix required a patch to Ruby, which GitLab bundled with its official packages but Alpine's custom container image did not include.
On October 20 and 21, the attacker submitted malicious CI configurations targeting the flaw, causing eight worker crashes; four were partially successful, though none appeared to succeed entirely. The Alpine team found that the attackers had downloaded its GitLab container image, suggesting they may have been preparing a supply chain attack.
The GitLab instance hosts development repositories, code reviews, and CI jobs, including the "aports" build recipes used to produce Alpine's software packages, making it a valuable supply chain target because tampering with the environment could affect downstream software. Potentially exposed information includes user details, password hashes, two-factor authentication secrets, CI/CD secrets, integration credentials and private project content, although no compromise of this data has been confirmed.
After investigating, Alpine found no tampering in repository commits, packages or releases up to October 27. No signing keys could have been exposed, as those are not stored on the GitLab server. However, because some incident logs are missing and outbound connection records are unavailable, the team could not rule out successful exploitation.
"Because we cannot rule out code execution, and the evidence we would need to confirm it no longer exists, we took the harder route and rebuilt the GitLab instance from scratch," the Alpine Linux team said.
Alpine advises users to reset their GitLab passwords and pull the alpinelinux/gitlab:19.3.6 image published on October 27, which contains Ruby 3.3.13 and addresses the vulnerability.
Analysis
Why This Matters
- Alpine Linux is widely used as the base for Docker container images; a successful compromise could have downstream effects on thousands of applications.
- The incident underscores the difficulty of ensuring the integrity of software supply chains when development infrastructure is targeted.
- The response, rebuilding the server from scratch, highlights the serious approach needed when evidence is incomplete.
Background
Alpine Linux is a lightweight Linux distribution commonly used as the base for Docker containers. Its development infrastructure is a valuable supply chain target because compromising it could allow attackers to inject malicious code into packages used by many downstream projects. The vulnerability involved GitLab's CI/CD regular expression compiler, which combines the Onigmo library with Ruby.
What to Watch
- Further investigation by Alpine Linux may reveal whether any code was injected before the attack window, given the missing logs.
- Organizations using self-hosted GitLab instances should be alert for potential exploitation of CVE-2026-97229, especially those using custom containers that may lack the Ruby patch.
- The broader open-source community will watch for signs of supply chain compromise related to Alpine Linux packages.
Checked
12 claims in this story checked against 1 source: 12 supported.
Show each claim
- SupportedAlpine Linux rebuilt its GitLab instance after an attempted remote code-execution attack.BleepingComputer: “Alpine Linux rebuilds GitLab after attempted RCE attack.”
- SupportedThe attempted exploit prompted a full GitLab rebuild and a reset of all passwords.BleepingComputer: “Hackers attempted to exploit a critical GitLab vulnerability in Alpine Linux's development infrastructure on October 20–21, prompting the open-source project to rebuild its GitLab server and reset all passwords over concerns of a possible compromise.”
- SupportedThe attackers targeted CVE-2026-97229 on October 20 and 21.BleepingComputer: “Hackers attempted to exploit a critical GitLab vulnerability in Alpine Linux's development infrastructure on October 20–21”
- SupportedThe attack caused eight worker crashes.BleepingComputer: “On October 20-21, the attacker submitted malicious CI configurations targeting the flaw, causing eight worker crashes; four were partially successful”
- SupportedFour attempts were partially successful, but none appeared to succeed completely.BleepingComputer: “four were partially successful, though none seemed to go all the way.”
- SupportedAlpine found no evidence of code execution or package tampering, but could not rule out compromise because logs were missing and outbound connection records were unavailable.BleepingComputer: “Although Alpine Linux found no evidence that attackers executed code or tampered with its software packages and releases, it could not rule out a successful compromise due to missing logs and a lack of outbound connection records.”
- SupportedThe Alpine Linux team said it rebuilt the instance from scratch because it could not rule out code execution and the evidence needed to confirm it no longer existed.BleepingComputer: “"Because we cannot rule out code execution, and the evidence we would need to confirm it no longer exists, we took the harder route and rebuilt the GitLab instance from scratch," explained the Alpine Linux team .”
- SupportedCVE-2026-97229 is an integer-overflow flaw in GitLab's CI/CD regular-expression compiler Onigmo, bundled in Ruby, that could let unauthenticated attackers execute arbitrary code.BleepingComputer: “CVE-2026-97229 is a maximum-severity integer overflow vulnerability in GitLab’s CI/CD regular expression compiler Onigmo, bundled in Ruby, that could allow unauthenticated attackers to execute arbitrary code on the server.”
- SupportedGitLab disclosed the flaw and made fixes available on October 12.BleepingComputer: “GitLab disclosed the flaw and made fixes available on October 12”
- SupportedAlpine first installed GitLab 19.3.4 instead of patched version 19.3.5; a later upgrade to 19.3.6 did not fix the flaw because the Alpine container image lacked the required Ruby patch.BleepingComputer: “Alpine initially installed GitLab 19.3.4 instead of the patched version, 19.3.5. A later upgrade to 19.3.6 also failed to close the flaw because the fix required a patch to Ruby, which GitLab bundled with its official packages but Alpine’s custom container image did not include.”
- SupportedThe attackers downloaded Alpine's GitLab container image, suggesting they may have been preparing a supply-chain attack.BleepingComputer: “The Alpine Linux team found that the attackers downloaded its GitLab container image, suggesting they may have been preparing a supply-chain attack.”
- SupportedAlpine advises users to reset GitLab passwords and pull the alpinelinux/gitlab:19.3.6 image, published October 27 with Ruby 3.3.13, which addresses the vulnerability.BleepingComputer: “Alpine advises users to reset their GitLab passwords and pull the alpinelinux/gitlab:19.3.6 image published on October 27, which contains Ruby 3.3.13 and addresses CVE-2026-97229.”
