Alpine Linux’s GitLab server was targeted last month after a critical vulnerability—CVE-2026-97229—was patched by GitLab, but the fix failed to reach Alpine’s setup due to its Ruby configuration. The vulnerability, carrying a maximum CVSS score of 10.0, allowed attackers to run code via malicious regular expressions in CI configurations. Alpine found no definitive proof the exploit succeeded, but rebuilt its server and reset user credentials out of caution.
What CVE-2026-97229 is—and why the GitLab update alone wasn’t enough
The root issue lies in Onigmo, Ruby’s regular expression engine, and how GitLab compiles regex patterns defined in CI configurations. A patch released by GitLab on October 12 updated the embedded Ruby inside its official packages and container images. However, Alpine’s GitLab image used an external, standard Ruby build. Since that wasn’t updated, the security hole persisted even after Alpine upgraded GitLab itself to version 19.3.6 on October 22. Alpine now advises updating Ruby to version 3.3.13, 3.4.12, 4.0.9 or later in self-compiled setups, or using their updated docker image tag 19.3.6 published on or after October 27.
Timeline: how the attack played out—and Alpine’s response
Alpine upgraded their GitLab server to 19.3.4 instead of 19.3.5 on October 13, missing the fix released earlier in October. The breach attempt began on October 20 via a recently created user, who tested crafted CI configurations over two days. The exploits caused crashes in GitLab worker processes repeatedly and triggered 502 errors during CI jobs managed by Alpine. In at least four crashes, the explorer got partway through the exploit chain. The attacker also downloaded the GitLab container image—signaling efforts to tailor the exploit to Alpine’s build.
After blocking the user on October 23, Alpine detected continued access attempts on October 25-26. The server was shut down to all but essential developers on October 27 in order to rebuild—including replacing secret keys and elevating Ruby to fixed versions. By October 28, the workaround efforts were completed, and the server was undergoing validation before reopening publicly.
What Alpine can and cannot determine (and what risks remain)
Despite a comprehensive investigation, Alpine found no direct evidence that arbitrary code execution or data exfiltration occurred: no stored hooks or unknown processes, no suspicious log entries, and no network or API calls indicative of a breach. However, gaps in logs—especially from background jobs and the server’s filesystem—and lack of monitoring of outbound connections leave uncertainty. Because a successful exploit could leave minimal traces, Alpine assumed a worst-case scenario and treated the server as compromised.
Potentially exposed data includes user names, emails, IP addresses, password hashes, tokens, CI/CD variables, secrets, private repositories, issues, and integration credentials. Alpine reset passwords and secret keys, though it’s unclear whether things like runner tokens or other tokens were refreshed.
Who’s impacted and what to do now
GitLab servers that use built-in or official packages, or official container images, are protected if updated to the newest releases for their branches. Self-compiled deployments or those that bundle their own Ruby (especially those still using Ruby 3.2, which reached end-of-life in April and received no fix) remain vulnerable. Administrators of those setups must update both GitLab and Ruby.
Other mitigation steps include restricting anonymous users from creating projects, limiting public projects, blocking certain CI lint routes, and applying GitLab’s experimental detection rules. These rules monitor unusual file paths, regex warnings, crash reports tied to Onigmo, and other suspicious behaviors.
Users of Alpine’s GitLab image should pull version 19.3.6 again—only the image published on or after October 27 includes the patched Ruby version. Alpine’s own Ruby packages already carry the fix through standard package upgrades.
Requiring both the application and runtime to be updated shows why layering patches without reviewing dependencies is risky—especially in open source ecosystems. This episode underlines the importance of not only applying vendor patches but ensuring underlying libraries like Ruby are also up to date. For admins: assume the worst after a suspicious incident, overhaul composable parts (including runtime), rotate secrets, and verify builds. Going forward, communities should expect clearer advisories from projects about dependencies—not just their primary software—whenever critical vulnerabilities emerge.
