Alpine Linux Rebuilds GitLab Server After Attack on CVSS 10.0 Flaw That a GitLab Upgrade Alone Did Not Fix

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-97229, a maximum-severity GitLab vulnerability, to its Known Exploited Vulnerabilities (KEV) catalog. The listing follows a disclosure by the Alpine Linux project on 28 October 2026. Alpine said an unknown attacker spent several days in October trying to use the flaw against the project's own GitLab server. Alpine found no proof that the attack worked. It still rebuilt the server from scratch, because it could not rule out a break-in, and because it found that its earlier GitLab upgrade had not closed the hole.

What happened

The sequence below is based on Alpine Linux's account as reported by The Hacker News, with SecurityWeek also covering the incident.

• 12 October: GitLab released a fix for CVE-2026-97229.
• 13 October: Alpine upgraded gitlab.alpinelinux.org to GitLab 19.3.4 rather than the fixed 19.3.5. Alpine has called this a mistake.
• 20–21 October: A newly registered account sent specially crafted CI configurations to the server. These crashed GitLab worker processes eight times. In four of those crashes, the attacker got partway through the exploit before it failed at the following stage. The main attack on 21 October also caused 502 errors and failed CI jobs. The attacker also downloaded Alpine's GitLab container image. Alpine said this suggested the attacker was tailoring the exploit to its exact build.
• 22 October: Alpine upgraded to GitLab 19.3.6.
• 23 October: Alpine blocked the attacker's account.
• 25–26 October: The attacker returned and tried to regain access. Those attempts failed.
• 26 October: Alpine discovered that the server was still vulnerable despite running 19.3.6.
• 27 October: Alpine restricted GitLab to its developers and build servers and began rebuilding.
• 28 October: The rebuild was completed. Alpine replaced GitLab's secret keys, reset every account's password, and moved to a fixed Ruby version. It is testing the new server before reopening it to the public.

CISA then added the flaw to KEV alongside an unrelated Cisco bug, CVE-2026-76418 (CVSS 8.6). That Cisco flaw is a denial-of-service issue in Secure Firewall ASA and FTD software, which Cisco says has been actively exploited this month.

Who is affected

According to the verified CVE record, the flaw affects GitLab Community Edition and Enterprise Edition in these versions:

• 19.2 before 19.2.8
• 19.3 before 19.3.5
• 19.4 before 19.4.2

There is an important catch. GitLab's fix works by patching the copy of Ruby that GitLab bundles in its official Linux packages and container images. Ruby is the programming language GitLab is built on. If you run GitLab on your own Ruby, for example by building from source or using a custom container image, upgrading GitLab does not change that Ruby. Your server stays vulnerable until Ruby itself is updated. Alpine's image used standard Ruby, which is why the 19.3.6 upgrade did not protect it.

Users of Alpine's alpinelinux/gitlab image are told to pull 19.3.6 again to get a corrected build.

For Alpine's own users, the project said its software supply chain appears intact. The project's aports repository, which Alpine's packages are built from, lives on the affected server. Alpine said every package built between 20 and 24 October, and the 21 October releases, came from aports changes that it verified against records outside GitLab. Those releases include the minirootfs files used to build official Alpine Docker images. Alpine is extending these checks to 27 October. It also noted that its package and release signing keys have never been stored on the GitLab server.

How it works

GitLab lets users define automated build and test pipelines, known as CI/CD, in configuration files. These files can contain regular expressions, which are compact patterns used to match text. GitLab compiles those patterns using Onigmo, the regular expression engine built into Ruby.

The bug sits inside Onigmo and is classed as CWE-190, an integer overflow or wraparound. This happens when a number grows larger than the space reserved for it and "wraps around" to an unexpected value, which can corrupt memory. According to the CVE description, insufficient validation of regular expressions means a carefully crafted pattern could let an unauthenticated attacker run arbitrary code on the GitLab server.

Alpine's experience shows that failed attempts can crash worker processes. However, Alpine warned that a successful exploit would leave no crash and no trace in the web logs. That makes after-the-fact detection difficult.

How serious is it?

The flaw carries a CVSS score of 10.0, the highest rating possible. It allows remote code execution without logging in, and CISA's KEV catalog lists it as known to be exploited. CISA has recommended that U.S. Federal Civilian Executive Branch agencies apply fixes by 1 November 2026.

The coverage frames the outcome slightly differently. The Hacker News's KEV report describes the attempt against Alpine as unsuccessful. SecurityWeek's headline says the flaw was "exploited against" Alpine. Alpine's own position is in between. It found no evidence of success: timing probes showed no delays, it found no unexpected files, keys, hooks or processes, and it saw no private data leave through web or API requests. But it cannot be certain. Some logs from the attack day are gone, including background job logs and the old container's filesystem. Neither Alpine nor its hosting provider recorded outbound network connections.

If the attack did succeed, Alpine said these could have been exposed:

• Names, email addresses and IP addresses of all users
• Two-factor authentication secrets, CI/CD variables and runner tokens
• Webhook, integration and push-mirror credentials
• Personal access tokens, which are stored as hashes
• Private repositories, confidential issues and merge requests

What to do now

For GitLab administrators:

• Upgrade to a fixed release: 19.2.8, 19.3.5, 19.4.2 or later in your branch.
• Check which Ruby your server actually uses. If it is not GitLab's bundled Ruby, update to Ruby 3.3.13, 3.4.12, 4.0.9 or later. As Alpine put it, "upgrading GitLab is not enough."
• If you use the alpinelinux/gitlab image, pull 19.3.6 again.
• Look for clusters of unexplained GitLab worker crashes or 502 errors, especially around CI configuration submissions from new accounts.
• If you were exposed and lack complete logs, consider treating the server as compromised. That means rebuilding it and rotating secrets, tokens and credentials.
• Make sure you log outbound network connections, so you can investigate future incidents.

For Alpine and gitlab.alpinelinux.org users:

• Expect a forced password reset, and choose a new, unique password.
• Consider re-enrolling two-factor authentication and replacing any personal access tokens, since these were among the potentially exposed data.
• Review any CI/CD variables, webhooks or mirror credentials you stored there, and rotate them where possible.
• Ordinary Alpine package users do not need to take action based on current findings. Alpine says its packages and releases were not tampered with.

What we still don't know

• Who the attacker is, and whether other GitLab servers were targeted.
• Whether any exploit attempt actually ran code. Alpine says the evidence needed to confirm this no longer exists.
• Whether Alpine has replaced runner tokens, CI/CD variables, access tokens or integration credentials beyond the password reset and new secret keys.
• What CISA's evidence of active exploitation includes beyond the Alpine incident. The available reporting links the listing to Alpine's disclosure.
• How many self-built GitLab installations still run unpatched Ruby.

ITVedas analysis: The most useful lesson here is not the CVSS score. It is that a fix shipped inside a vendor's bundled dependencies can quietly skip anyone who supplies those dependencies themselves. Alpine deserves credit for a candid disclosure and a cautious rebuild. Every team running GitLab on its own Ruby should check that Ruby version today.