Alpine Linux rebuilds GitLab server after hackers target critical RCE flaw
Hackers repeatedly tried to exploit a maximum-severity GitLab remote code execution flaw in Alpine Linux's development infrastructure on October 20 and 21, prompting the project to rebuild its GitLab server from scratch and reset all passwords. Alpine found no evidence of a successful compromise but could not rule one out because key logs were missing.
BleepingComputer
Hackers attempted to exploit a maximum-severity GitLab vulnerability in Alpine Linux's development infrastructure on October 20 and 21, prompting the open-source project to rebuild its GitLab server and reset all passwords over concerns of a possible compromise.
The attacks targeted CVE-2026-97229, a remote code execution flaw, and repeatedly crashed GitLab processes, with some attempts coming close to succeeding. Although Alpine Linux found no evidence that attackers executed code or tampered with its software packages and releases, it could not rule out a successful compromise due to missing logs and a lack of outbound connection records. "Because we cannot rule out code execution, and the evidence we would need to confirm it no longer exists, we took the harder route and rebuilt the GitLab instance from scratch," the Alpine Linux team explained.
Alpine Linux is a small, lightweight operating system widely used as the foundation for Docker container images that run applications and services. Its GitLab instance hosts development repositories, code reviews, and CI jobs, including the "aports" build recipes used to produce Alpine's software packages. That makes it a valuable supply chain target, since tampering with the GitLab environment could affect downstream software.
CVE-2026-97229 is a maximum-severity integer overflow vulnerability in GitLab's CI/CD regular expression compiler Onigmo, which is bundled in Ruby. It could allow unauthenticated attackers to execute arbitrary code on the server. GitLab disclosed the flaw and made fixes available on October 12, warning that attackers can trigger it under certain conditions by submitting a specially crafted regular expression in a CI/CD pipeline configuration.
Alpine's patching efforts initially fell short. The project installed GitLab 19.3.4 instead of the patched version, 19.3.5, and a later upgrade to 19.3.6 also failed to close the flaw. The fix required a patch to Ruby, which GitLab bundles with its official packages but Alpine's custom container image did not include.
On October 20 and 21, the attacker submitted malicious CI configurations targeting the flaw, causing eight worker crashes. Four were partially successful, though none appeared to go all the way. The Alpine Linux team also found that the attackers downloaded its GitLab container image, suggesting they may have been preparing a supply chain attack.
After investigating, Alpine found no tampering in repository commits, packages, or releases up to October 27. It also determined that no signing keys could have been exposed, as those are not stored on the GitLab server. If exploitation had succeeded, potentially exposed information includes user details, password hashes, 2FA secrets, CI/CD secrets, integration credentials, and private project content, though no compromise of that data has been confirmed.
Alpine advises users to reset their GitLab passwords and pull the alpinelinux/gitlab:19.3.6 image published on October 27, which contains Ruby 3.3.13 and addresses CVE-2026-97229.