Hackers attempted to exploit a critical GitLab vulnerability in Alpine Linux’s development infrastructure between October 20 and 21, prompting the project to rebuild its GitLab servers and reset all passwords. The attacks caused repeated process crashes, and while several attempts came close to succeeding, Alpine Linux found no evidence that attackers executed code or altered packages or releases. However, missing logs and outbound connection records meant the project could not completely rule out a successful compromise.
Attack targeted a critical GitLab vulnerability
The attacks targeted CVE-2026-97229, a maximum-severity integer overflow vulnerability in Onigmo, the regular expression compiler used by GitLab’s CI/CD system and bundled with Ruby. An unauthenticated attacker could exploit the flaw to execute arbitrary code on a server.
GitLab disclosed the vulnerability and released a fix on October 12. Under certain conditions, an attacker could trigger it by submitting a specially crafted regular expression in a CI/CD pipeline configuration.
Alpine initially installed GitLab 19.3.4 rather than the patched 19.3.5 release. A later upgrade to version 19.3.6 did not address the issue because the fix required a Ruby patch. Although GitLab included that patch in its official package, it was missing from Alpine’s custom container image.
Between October 20 and 21, attackers submitted malicious CI configurations designed to exploit the vulnerability. The activity caused eight worker crashes. Four attempts were partially successful, but none appeared to achieve complete success.
“Since we cannot rule out code execution and the necessary evidence to confirm it no longer exists, we took the harder route and rebuilt our GitLab instance from scratch,” the Alpine Linux team explained.
Potential supply chain risk
Alpine Linux is a small, lightweight operating system widely used as the foundation for Docker container images that run applications and services. Its GitLab instance hosts development repositories, code reviews and CI jobs containing the “aports” build recipes used to create Alpine software packages.
Because tampering with this environment could affect downstream software, the GitLab instance represented a potential software supply chain target. During its investigation, Alpine found that the attackers had downloaded GitLab container images, suggesting they may have been preparing a supply chain attack.
Alpine reported no evidence of tampering with repository commits, packages or releases through October 27. The project’s signing key is not stored on the GitLab server, making it unlikely that the key was exposed.
Source: Alpine Linux
Alpine recommends password resets
A successful exploit could potentially expose user details, password hashes, two-factor authentication secrets, CI/CD secrets, integration credentials and private project content. Alpine Linux said it had not seen evidence that any of these had been compromised.
Nevertheless, the project advises users to reset their GitLab passwords and pull the alpinelinux/gitlab:19.3.6 image published on October 27. The image includes Ruby 3.3.13 and addresses CVE-2026-97229.
Source: www.bleepingcomputer.com